netdev - Re: [PATCH net] net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241018141710.GO1697@kernel.org>
Date: Fri, 18 Oct 2024 15:17:10 +0100
From: Simon Horman <horms@...nel.org>
To: Vladimir Oltean <vladimir.oltean@....com>
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Andrew Lunn <andrew@...n.ch>, Petr Machata <petrm@...dia.com>,
	Ido Schimmel <idosch@...dia.com>, Vlad Buslov <vladbu@...dia.com>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>,
	Baowen Zheng <baowen.zheng@...igine.com>,
	Pedro Tammela <pctammela@...atatu.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net/sched: act_api: deny mismatched skip_sw/skip_hw
 flags for actions created by classifiers

On Thu, Oct 17, 2024 at 07:10:48PM +0300, Vladimir Oltean wrote:
> tcf_action_init() has logic for checking mismatches between action and
> filter offload flags (skip_sw/skip_hw). AFAIU, this is intended to run
> on the transition between the new tc_act_bind(flags) returning true (aka
> now gets bound to classifier) and tc_act_bind(act->tcfa_flags) returning
> false (aka action was not bound to classifier before). Otherwise, the
> check is skipped.
> 
> For the case where an action is not standalone, but rather it was
> created by a classifier and is bound to it, tcf_action_init() skips the
> check entirely, and this means it allows mismatched flags to occur.
> 
> Taking the matchall classifier code path as an example (with mirred as
> an action), the reason is the following:
> 
>  1 | mall_change()
>  2 | -> mall_replace_hw_filter()
>  3 |   -> tcf_exts_validate_ex()
>  4 |      -> flags |= TCA_ACT_FLAGS_BIND;
>  5 |      -> tcf_action_init()
>  6 |         -> tcf_action_init_1()
>  7 |            -> a_o->init()
>  8 |               -> tcf_mirred_init()
>  9 |                  -> tcf_idr_create_from_flags()
> 10 |                     -> tcf_idr_create()
> 11 |                        -> p->tcfa_flags = flags;
> 12 |         -> tc_act_bind(flags))
> 13 |         -> tc_act_bind(act->tcfa_flags)
> 
> When invoked from tcf_exts_validate_ex() like matchall does (but other
> classifiers validate their extensions as well), tcf_action_init() runs
> in a call path where "flags" always contains TCA_ACT_FLAGS_BIND (set by
> line 4). So line 12 is always true, and line 13 is always true as well.
> No transition ever takes place, and the check is skipped.
> 
> The code was added in this form in commit c86e0209dc77 ("flow_offload:
> validate flags of filter and actions"), but I'm attributing the blame
> even earlier in that series, to when TCA_ACT_FLAGS_SKIP_HW and
> TCA_ACT_FLAGS_SKIP_SW were added to the UAPI.
> 
> Following the development process of this change, the check did not
> always exist in this form. A change took place between v3 [1] and v4 [2],
> AFAIU due to review feedback that it doesn't make sense for action flags
> to be different than classifier flags. I think I agree with that
> feedback, but it was translated into code that omits enforcing this for
> "classic" actions created at the same time with the filters themselves.
> 
> There are 3 more important cases to discuss. First there is this command:
> 
> $ tc qdisc add dev eth0 clasct
> $ tc filter add dev eth0 ingress matchall skip_sw \
> 	action mirred ingress mirror dev eth1
> 
> which should be allowed, because prior to the concept of dedicated
> action flags, it used to work and it used to mean the action inherited
> the skip_sw/skip_hw flags from the classifier. It's not a mismatch.
> 
> Then we have this command:
> 
> $ tc qdisc add dev eth0 clasct
> $ tc filter add dev eth0 ingress matchall skip_sw \
> 	action mirred ingress mirror dev eth1 skip_hw
> 
> where there is a mismatch and it should be rejected.
> 
> Finally, we have:
> 
> $ tc qdisc add dev eth0 clasct
> $ tc filter add dev eth0 ingress matchall skip_sw \
> 	action mirred ingress mirror dev eth1 skip_sw
> 
> where the offload flags coincide, and this should be treated the same as
> the first command based on inheritance, and accepted.
> 
> [1]: https://lore.kernel.org/netdev/20211028110646.13791-9-simon.horman@corigine.com/
> [2]: https://lore.kernel.org/netdev/20211118130805.23897-10-simon.horman@corigine.com/
> Fixes: 7adc57651211 ("flow_offload: add skip_hw and skip_sw to control if offload the action")
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>

Thanks Vladimir,

This looks like an oversight to me.

Reviewed-by: Simon Horman <horms@...nel.org>