netdev - Re: [PATCH 5.10 228/290] tracing/net_sched: NULL pointer dereference in perf_trace_qdisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <65a38070-cccf-45a0-af10-fd482eab64be@gmail.com>
Date: Wed, 3 Jul 2024 20:42:48 +0900
From: Yunseong Kim <yskelg@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org
Cc: patches@...ts.linux.dev, netdev@...r.kernel.org,
 Yeoreum Yun <yeoreum.yun@....com>, Paolo Abeni <pabeni@...hat.com>,
 Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 5.10 228/290] tracing/net_sched: NULL pointer dereference
 in perf_trace_qdisc_reset()

Hi Greg,

On 7/3/24 7:40 오후, Greg Kroah-Hartman wrote:
> 5.10-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Yunseong Kim <yskelg@...il.com>
> 
> [ Upstream commit bab4923132feb3e439ae45962979c5d9d5c7c1f1 ]
> 
> In the TRACE_EVENT(qdisc_reset) NULL dereference occurred from
> 
>  qdisc->dev_queue->dev <NULL> ->name
> 
> This situation simulated from bunch of veths and Bluetooth disconnection
> and reconnection.
> 
> During qdisc initialization, qdisc was being set to noop_queue.
> In veth_init_queue, the initial tx_num was reduced back to one,
> causing the qdisc reset to be called with noop, which led to the kernel
> panic.


> Fixes: 51270d573a8d ("tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string")
> Link: https://lore.kernel.org/lkml/20240229143432.273b4871@gandalf.local.home/t/
> Cc: netdev@...r.kernel.org
> Tested-by: Yunseong Kim <yskelg@...il.com>
> Signed-off-by: Yunseong Kim <yskelg@...il.com>
> Signed-off-by: Yeoreum Yun <yeoreum.yun@....com>
> Link: https://lore.kernel.org/r/20240624173320.24945-4-yskelg@gmail.com
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  include/trace/events/qdisc.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h
> index a50df41634c58..f661d3d7c410a 100644
> --- a/include/trace/events/qdisc.h
> +++ b/include/trace/events/qdisc.h
> @@ -53,7 +53,7 @@ TRACE_EVENT(qdisc_reset,
>  	TP_ARGS(q),
>  
>  	TP_STRUCT__entry(
> -		__string(	dev,		qdisc_dev(q)->name	)
> +		__string(	dev,		qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"	)
>  		__string(	kind,		q->ops->id		)
>  		__field(	u32,		parent			)
>  		__field(	u32,		handle			)

Since that code changed in +v5.10.213, +v5.15.152, +v6.1.82 +v6.6.22
+v6.7.10, +v6.8, +6.9 and the stable is in an intermediate state.

commit 2c92ca849fcc ("tracing/treewide: Remove second parameter of
__assign_str()")
Link:
https://lore.kernel.org/linux-trace-kernel/20240516133454.681ba6a0@rorschach.local.home/


I had to fix some other part for the stable branch backporting.


So, I submit another patch. Please check out.
Link:
https://lore.kernel.org/stable/20240702180146.5126-2-yskelg@gmail.com/T/#u

---
 include/trace/events/qdisc.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h
index 1f4258308b96..061fd4960303 100644
--- a/include/trace/events/qdisc.h
+++ b/include/trace/events/qdisc.h
@@ -81,14 +81,14 @@ TRACE_EVENT(qdisc_reset,
 	TP_ARGS(q),

 	TP_STRUCT__entry(
-		__string(	dev,		qdisc_dev(q)->name	)
+		__string(	dev,		qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"	)
 		__string(	kind,		q->ops->id		)
 		__field(	u32,		parent			)
 		__field(	u32,		handle			)
 	),

 	TP_fast_assign(
-		__assign_str(dev, qdisc_dev(q)->name);
+		__assign_str(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)");
 		__assign_str(kind, q->ops->id);
 		__entry->parent = q->parent;
 		__entry->handle = q->handle;
--