WANG Cong 69301eaa7f net_sched: fix a null pointer dereference in tcindex_set_parms() ... This patch fixes the following crash: [ 42.199159] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 42.200027] IP: [<ffffffff817e3fc4>] tcindex_set_parms+0x45c/0x526 [ 42.200027] PGD d2319067 PUD d4ffe067 PMD 0 [ 42.200027] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC [ 42.200027] CPU: 0 PID: 541 Comm: tc Not tainted 3.17.0-rc4+ #603 [ 42.200027] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 42.200027] task: ffff8800d22d2670 ti: ffff8800ce790000 task.ti: ffff8800ce790000 [ 42.200027] RIP: 0010:[<ffffffff817e3fc4>] [<ffffffff817e3fc4>] tcindex_set_parms+0x45c/0x526 [ 42.200027] RSP: 0018:ffff8800ce793898 EFLAGS: 00010202 [ 42.200027] RAX: 0000000000000001 RBX: ffff8800d1786498 RCX: 0000000000000000 [ 42.200027] RDX: ffffffff82114ec8 RSI: ffffffff82114ec8 RDI: ffffffff82114ec8 [ 42.200027] RBP: ffff8800ce793958 R08: 00000000000080d0 R09: 0000000000000001 [ 42.200027] R10: ffff8800ce7939a0 R11: 0000000000000246 R12: ffff8800d017d238 [ 42.200027] R13: 0000000000000018 R14: ffff8800d017c6a0 R15: ffff8800d1786620 [ 42.200027] FS: 00007f4e24539740(0000) GS:ffff88011a600000(0000) knlGS:0000000000000000 [ 42.200027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.200027] CR2: 0000000000000018 CR3: 00000000cff38000 CR4: 00000000000006f0 [ 42.200027] Stack: [ 42.200027] ffff8800ce0949f0 0000000000000000 0000000200000003 ffff880000000000 [ 42.200027] ffff8800ce7938b8 ffff8800ce7938b8 0000000600000007 0000000000000000 [ 42.200027] ffff8800ce7938d8 ffff8800ce7938d8 0000000600000007 ffff8800ce0949f0 [ 42.200027] Call Trace: [ 42.200027] [<ffffffff817e4169>] tcindex_change+0xdb/0xee [ 42.200027] [<ffffffff817c16ca>] tc_ctl_tfilter+0x44d/0x63f [ 42.200027] [<ffffffff8179d161>] rtnetlink_rcv_msg+0x181/0x194 [ 42.200027] [<ffffffff8179cf9d>] ? rtnl_lock+0x17/0x19 [ 42.200027] [<ffffffff8179cfe0>] ? __rtnl_unlock+0x17/0x17 [ 42.200027] [<ffffffff817ee296>] netlink_rcv_skb+0x49/0x8b [ 43.462494] [<ffffffff8179cfc2>] rtnetlink_rcv+0x23/0x2a [ 43.462494] [<ffffffff817ec8df>] netlink_unicast+0xc7/0x148 [ 43.462494] [<ffffffff817ed413>] netlink_sendmsg+0x5cb/0x63d [ 43.462494] [<ffffffff810ad781>] ? mark_lock+0x2e/0x224 [ 43.462494] [<ffffffff817757b8>] __sock_sendmsg_nosec+0x25/0x27 [ 43.462494] [<ffffffff81778165>] sock_sendmsg+0x57/0x71 [ 43.462494] [<ffffffff81152bbd>] ? might_fault+0x57/0xa4 [ 43.462494] [<ffffffff81152c06>] ? might_fault+0xa0/0xa4 [ 43.462494] [<ffffffff81152bbd>] ? might_fault+0x57/0xa4 [ 43.462494] [<ffffffff817838fd>] ? verify_iovec+0x69/0xb7 [ 43.462494] [<ffffffff817784f8>] ___sys_sendmsg+0x21d/0x2bb [ 43.462494] [<ffffffff81009db3>] ? native_sched_clock+0x35/0x37 [ 43.462494] [<ffffffff8109ab53>] ? sched_clock_local+0x12/0x72 [ 43.462494] [<ffffffff810ad781>] ? mark_lock+0x2e/0x224 [ 43.462494] [<ffffffff8109ada4>] ? sched_clock_cpu+0xa0/0xb9 [ 43.462494] [<ffffffff810aee37>] ? __lock_acquire+0x5fe/0xde4 [ 43.462494] [<ffffffff8119f570>] ? rcu_read_lock_held+0x36/0x38 [ 43.462494] [<ffffffff8119f75a>] ? __fcheck_files.isra.7+0x4b/0x57 [ 43.462494] [<ffffffff8119fbf2>] ? __fget_light+0x30/0x54 [ 43.462494] [<ffffffff81779012>] __sys_sendmsg+0x42/0x60 [ 43.462494] [<ffffffff81779042>] SyS_sendmsg+0x12/0x1c [ 43.462494] [<ffffffff819d24d2>] system_call_fastpath+0x16/0x1b 'p->h' could be NULL while 'cp->h' is always update to date. Fixes: commit 331b72922c ("net: sched: RCU cls_tcindex") Cc: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-By: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-09-16 15:20:09 -04:00
..
act_api.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
act_csum.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_gact.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_ipt.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_mirred.c	net_sched: hold tcf_lock in netdevice notifier	2014-07-20 20:31:42 -07:00
act_nat.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_pedit.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_police.c	net: use ktime_get_ns() and ktime_get_real_ns() helpers	2014-08-22 19:57:23 -07:00
act_simple.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
act_skbedit.c	net_sched: act: move tcf_hashinfo_init() into tcf_register_action()	2014-02-12 19:23:32 -05:00
cls_api.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
cls_basic.c	net: sched: cls_basic use RCU	2014-09-13 12:30:25 -04:00
cls_bpf.c	net_sched: fix suspicious RCU usage in cls_bpf_classify()	2014-09-15 17:42:08 -04:00
cls_cgroup.c	net: sched: cls_cgroup use RCU	2014-09-13 12:30:26 -04:00
cls_flow.c	net: sched: cls_flow use RCU	2014-09-13 12:30:26 -04:00
cls_fw.c	net: sched: fw use RCU	2014-09-13 12:30:26 -04:00
cls_route.c	net: sched: RCU cls_route	2014-09-13 12:30:26 -04:00
cls_rsvp.c
cls_rsvp.h	net: sched: rcu'ify cls_rsvp	2014-09-13 12:30:26 -04:00
cls_rsvp6.c
cls_tcindex.c	net_sched: fix a null pointer dereference in tcindex_set_parms()	2014-09-16 15:20:09 -04:00
cls_u32.c	net: sched: make cls_u32 lockless	2014-09-13 12:30:26 -04:00
em_canid.c	net: em_canid: remove useless statements from em_canid_change	2014-06-21 15:40:22 -07:00
em_cmp.c
em_ipset.c	em_ipset: use dev_net() accessor	2013-10-18 16:23:06 -04:00
em_meta.c	net: Change skb_get_rxhash to skb_get_hash	2013-12-17 16:36:21 -05:00
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig	net: pkt_sched: PIE AQM scheme	2014-01-06 15:13:01 -05:00
Makefile	net: pkt_sched: PIE AQM scheme	2014-01-06 15:13:01 -05:00
sch_api.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_atm.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_blackhole.c
sch_cbq.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_choke.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_codel.c
sch_drr.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_dsmark.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_fifo.c
sch_fq.c	net: use ktime_get_ns() and ktime_get_real_ns() helpers	2014-08-22 19:57:23 -07:00
sch_fq_codel.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_generic.c	net: qdisc: use rcu prefix and silence sparse warnings	2014-09-13 12:30:25 -04:00
sch_gred.c	net_sched: replace pr_warning with pr_warn	2013-12-31 13:50:56 -05:00
sch_hfsc.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_hhf.c	net: use the new API kvfree()	2014-06-05 00:49:51 -07:00
sch_htb.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_ingress.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_mq.c	pkt_sched: give visibility to mq slave qdiscs	2013-12-09 19:54:47 -05:00
sch_mqprio.c	net: qdisc: use rcu prefix and silence sparse warnings	2014-09-13 12:30:25 -04:00
sch_multiq.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_netem.c	net: use the new API kvfree()	2014-06-05 00:49:51 -07:00
sch_pie.c	net: sched: Cleanup PIE comments	2014-02-13 18:29:58 -05:00
sch_plug.c
sch_prio.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_qfq.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_red.c
sch_sfb.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_sfq.c	net: rcu-ify tcf_proto	2014-09-13 12:30:25 -04:00
sch_tbf.c	net: use ktime_get_ns() and ktime_get_real_ns() helpers	2014-08-22 19:57:23 -07:00
sch_teql.c	net: qdisc: use rcu prefix and silence sparse warnings	2014-09-13 12:30:25 -04:00