netdev - Re: tc qdisc kernel crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAM_iQpXvQWy9mD7QSY0Uz+UjAb9-axm5=7O=oun=wZidFmqQDQ@mail.gmail.com>
Date:   Sun, 10 Feb 2019 10:30:50 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Ben Hutchings <ben@...adent.org.uk>
Cc:     netdev <netdev@...r.kernel.org>, 921542@...s.debian.org,
        Adrian <bugs@...elecom.ro>
Subject: Re: tc qdisc kernel crash

On Sun, Feb 10, 2019 at 7:54 AM Ben Hutchings <ben@...adent.org.uk> wrote:
>
> Control: tag -1 confirmed upstream
> Control: found -1 4.20-1~exp1
>
> Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script
> using tc could trigger a kernel crash.  I've simplified the script he
> provided down to:
>
> --- BEGIN ---
> #!/bin/sh -ex
>
> modprobe ifb
>
> while true; do
>     tc qdisc add dev ifb0 root handle 2:0 prio bands 5
>     tc qdisc add dev ifb0 parent 2:5 sfq
>     tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mask 0 classid 2:5 pass_on
>     tc qdisc del dev ifb0 root || true
> done
> --- END ---
>
> The crash is still reproducible in 4.20 and 5.0-rc5.  KASan shows a
> use-after-free:

Thanks for the reproducer and report! I will send a fix.