OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/net/sched
History
Jacob Keller 83fe6b8709 sch_fq_codel: zero q->flows_cnt when fq_codel_init fails 
When fq_codel_init fails, qdisc_create_dflt will cleanup by using
qdisc_destroy. This function calls the ->reset() op prior to calling the
->destroy() op.

Unfortunately, during the failure flow for sch_fq_codel, the ->flows
parameter is not initialized, so the fq_codel_reset function will null
pointer dereference.

   kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
   kernel: IP: fq_codel_reset+0x58/0xd0 [sch_fq_codel]
   kernel: PGD 0 P4D 0
   kernel: Oops: 0000 [#1] SMP PTI
   kernel: Modules linked in: i40iw i40e(OE) xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc devlink ebtable_filter ebtables ip6table_filter ip6_tables rpcrdma ib_isert iscsi_target_mod sunrpc ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm intel_rapl sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel intel_cstate iTCO_wdt iTCO_vendor_support intel_uncore ib_core intel_rapl_perf mei_me mei joydev i2c_i801 lpc_ich ioatdma shpchp wmi sch_fq_codel xfs libcrc32c mgag200 ixgbe drm_kms_helper isci ttm firewire_ohci
   kernel:  mdio drm igb libsas crc32c_intel firewire_core ptp pps_core scsi_transport_sas crc_itu_t dca i2c_algo_bit ipmi_si ipmi_devintf ipmi_msghandler [last unloaded: i40e]
   kernel: CPU: 10 PID: 4219 Comm: ip Tainted: G           OE    4.16.13custom-fq-codel-test+ #3
   kernel: Hardware name: Intel Corporation S2600CO/S2600CO, BIOS SE5C600.86B.02.05.0004.051120151007 05/11/2015
   kernel: RIP: 0010:fq_codel_reset+0x58/0xd0 [sch_fq_codel]
   kernel: RSP: 0018:ffffbfbf4c1fb620 EFLAGS: 00010246
   kernel: RAX: 0000000000000400 RBX: 0000000000000000 RCX: 00000000000005b9
   kernel: RDX: 0000000000000000 RSI: ffff9d03264a60c0 RDI: ffff9cfd17b31c00
   kernel: RBP: 0000000000000001 R08: 00000000000260c0 R09: ffffffffb679c3e9
   kernel: R10: fffff1dab06a0e80 R11: ffff9cfd163af800 R12: ffff9cfd17b31c00
   kernel: R13: 0000000000000001 R14: ffff9cfd153de600 R15: 0000000000000001
   kernel: FS:  00007fdec2f92800(0000) GS:ffff9d0326480000(0000) knlGS:0000000000000000
   kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   kernel: CR2: 0000000000000008 CR3: 0000000c1956a006 CR4: 00000000000606e0
   kernel: Call Trace:
   kernel:  qdisc_destroy+0x56/0x140
   kernel:  qdisc_create_dflt+0x8b/0xb0
   kernel:  mq_init+0xc1/0xf0
   kernel:  qdisc_create_dflt+0x5a/0xb0
   kernel:  dev_activate+0x205/0x230
   kernel:  __dev_open+0xf5/0x160
   kernel:  __dev_change_flags+0x1a3/0x210
   kernel:  dev_change_flags+0x21/0x60
   kernel:  do_setlink+0x660/0xdf0
   kernel:  ? down_trylock+0x25/0x30
   kernel:  ? xfs_buf_trylock+0x1a/0xd0 [xfs]
   kernel:  ? rtnl_newlink+0x816/0x990
   kernel:  ? _xfs_buf_find+0x327/0x580 [xfs]
   kernel:  ? _cond_resched+0x15/0x30
   kernel:  ? kmem_cache_alloc+0x20/0x1b0
   kernel:  ? rtnetlink_rcv_msg+0x200/0x2f0
   kernel:  ? rtnl_calcit.isra.30+0x100/0x100
   kernel:  ? netlink_rcv_skb+0x4c/0x120
   kernel:  ? netlink_unicast+0x19e/0x260
   kernel:  ? netlink_sendmsg+0x1ff/0x3c0
   kernel:  ? sock_sendmsg+0x36/0x40
   kernel:  ? ___sys_sendmsg+0x295/0x2f0
   kernel:  ? ebitmap_cmp+0x6d/0x90
   kernel:  ? dev_get_by_name_rcu+0x73/0x90
   kernel:  ? skb_dequeue+0x52/0x60
   kernel:  ? __inode_wait_for_writeback+0x7f/0xf0
   kernel:  ? bit_waitqueue+0x30/0x30
   kernel:  ? fsnotify_grab_connector+0x3c/0x60
   kernel:  ? __sys_sendmsg+0x51/0x90
   kernel:  ? do_syscall_64+0x74/0x180
   kernel:  ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2
   kernel: Code: 00 00 48 89 87 00 02 00 00 8b 87 a0 01 00 00 85 c0 0f 84 84 00 00 00 31 ed 48 63 dd 83 c5 01 48 c1 e3 06 49 03 9c 24 90 01 00 00 <48> 8b 73 08 48 8b 3b e8 6c 9a 4f f6 48 8d 43 10 48 c7 03 00 00
   kernel: RIP: fq_codel_reset+0x58/0xd0 [sch_fq_codel] RSP: ffffbfbf4c1fb620
   kernel: CR2: 0000000000000008
   kernel: ---[ end trace e81a62bede66274e ]---

This is caused because flows_cnt is non-zero, but flows hasn't been
initialized. fq_codel_init has left the private data in a partially
initialized state.

To fix this, reset flows_cnt to 0 when we fail to initialize.
Additionally, to make the state more consistent, also cleanup the flows
pointer when the allocation of backlogs fails.

This fixes the NULL pointer dereference, since both the for-loop and
memset in fq_codel_reset will be no-ops when flow_cnt is zero.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2018-07-12 12:32:09 -07:00
..
Kconfig net: sched: add em_ipt ematch for calling xtables matches 2018-02-21 13:15:33 -05:00
Makefile net: sched: add em_ipt ematch for calling xtables matches 2018-02-21 13:15:33 -05:00
act_api.c net: sched: don't disable bh when accessing action idr 2018-05-22 15:34:34 -04:00
act_bpf.c net/sched: fix NULL dereference in the error path of tcf_bpf_init() 2018-04-05 22:26:06 -04:00
act_connmark.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_csum.c net/sched: act_csum: fix NULL dereference when 'goto chain' is used 2018-07-07 22:01:08 +09:00
act_gact.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_ife.c net/sched: act_ife: preserve the action control in case of error 2018-06-20 09:03:58 +09:00
act_ipt.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_meta_mark.c net: remove duplicate includes 2017-12-13 13:18:46 -05:00
act_meta_skbprio.c
…
act_meta_skbtcindex.c net: remove duplicate includes 2017-12-13 13:18:46 -05:00
act_mirred.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_nat.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_pedit.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_police.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_sample.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
act_simple.c net/sched: act_simple: fix parsing of TCA_DEF_DATA 2018-06-08 18:49:19 -04:00
act_skbedit.c net sched actions: fix invalid pointer dereferencing if skbedit flags missing 2018-05-11 15:52:43 -04:00
act_skbmod.c net sched actions: fix refcnt leak in skbmod 2018-05-11 16:37:03 -04:00
act_tunnel_key.c net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used 2018-07-07 22:01:08 +09:00
act_vlan.c net/sched: fix refcnt leak in the error path of tcf_vlan_init() 2018-05-16 14:41:44 -04:00
cls_api.c Revert "net: sched: cls: Fix offloading when ingress dev is vxlan" 2018-06-06 13:55:47 -04:00
cls_basic.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_bpf.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_cgroup.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_flow.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_flower.c cls_flower: fix use after free in flower S/W path 2018-06-22 07:24:07 +09:00
cls_fw.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_matchall.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_route.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_rsvp.c
…
cls_rsvp.h net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_rsvp6.c
…
cls_tcindex.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
cls_u32.c net_sched: switch to rcu_work 2018-05-24 22:56:15 -04:00
em_canid.c
…
em_cmp.c
…
em_ipset.c
…
em_ipt.c net: sched: add em_ipt ematch for calling xtables matches 2018-02-21 13:15:33 -05:00
em_meta.c
…
em_nbyte.c net: sched: em_nbyte: don't add the data offset twice 2018-01-24 14:52:40 -05:00
em_text.c
…
em_u32.c
…
ematch.c
…
sch_api.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
sch_atm.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_blackhole.c net_sched: blackhole: tell upper qdisc about dropped packets 2018-06-17 08:42:33 +09:00
sch_cbq.c net: sch: sch_cbq: add extack support 2017-12-21 12:32:51 -05:00
sch_cbs.c net: sch: sch_cbs: add extack support 2017-12-21 12:32:51 -05:00
sch_choke.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_codel.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_drr.c net: sch: sch_drr: add extack support 2017-12-21 12:32:51 -05:00
sch_dsmark.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_fifo.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_fq.c net_sched: fq: take care of throttled flows before reuse 2018-05-02 16:37:38 -04:00
sch_fq_codel.c sch_fq_codel: zero q->flows_cnt when fq_codel_init fails 2018-07-12 12:32:09 -07:00
sch_generic.c net: remove bypassed check in sch_direct_xmit() 2018-05-31 13:26:19 -04:00
sch_gred.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_hfsc.c net_sched: remove a bogus warning in hfsc 2018-06-23 10:58:46 +09:00
sch_hhf.c treewide: kvzalloc() -> kvcalloc() 2018-06-12 16:19:22 -07:00
sch_htb.c net: sched: do not emit messages while holding spinlock 2018-04-01 20:53:50 -04:00
sch_ingress.c net: sched: allow ingress and clsact qdiscs to share filter blocks 2018-01-17 14:53:57 -05:00
sch_mq.c net: sched: mq: request stats from offloads 2018-05-29 09:49:16 -04:00
sch_mqprio.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_multiq.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_netem.c sch_netem: fix skb leak in netem_enqueue() 2018-03-07 11:18:14 -05:00
sch_pie.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_plug.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_prio.c net: sch: prio: Add offload ability for grafting a child 2018-02-28 12:06:01 -05:00
sch_qfq.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_red.c net: sched: red: avoid hashing NULL child 2018-05-18 13:52:32 -04:00
sch_sfb.c net: sch: api: add extack support in qdisc_create_dflt 2017-12-21 12:32:51 -05:00
sch_sfq.c net: sch: api: add extack support in tcf_block_get 2017-12-21 12:32:51 -05:00
sch_tbf.c net: sched: red: avoid hashing NULL child 2018-05-18 13:52:32 -04:00
sch_teql.c net: sched: sch: add extack for init callback 2017-12-21 12:32:50 -05:00