netdev - Re: [PATCH net] sch_netem: fix issues in netem_change() vs get_dist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 Jun 2023 09:54:42 +0200
From: Simon Horman <simon.horman@...igine.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, eric.dumazet@...il.com,
	syzbot <syzkaller@...glegroups.com>,
	Stephen Hemminger <stephen@...workplumber.org>,
	Jamal Hadi Salim <jhs@...atatu.com>
Subject: Re: [PATCH net] sch_netem: fix issues in netem_change() vs
 get_dist_table()

On Thu, Jun 22, 2023 at 06:15:03PM +0000, Eric Dumazet wrote:
> In blamed commit, I missed that get_dist_table() was allocating
> memory using GFP_KERNEL, and acquiring qdisc lock to perform
> the swap of newly allocated table with current one.
> 
> In this patch, get_dist_table() is allocating memory and
> copy user data before we acquire the qdisc lock.
> 
> Then we perform swap operations while being protected by the lock.
> 
> Note that after this patch netem_change() no longer can do partial changes.
> If an error is returned, qdisc conf is left unchanged.
> 
> Fixes: 2174a08db80d ("sch_netem: acquire qdisc lock in netem_change()")
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Stephen Hemminger <stephen@...workplumber.org>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Simon Horman <simon.horman@...igine.com>
> ---
>  net/sched/sch_netem.c | 59 ++++++++++++++++++-------------------------
>  1 file changed, 25 insertions(+), 34 deletions(-)

Reviewed-by: Simon Horman <simon.horman@...igine.com>