![Roman Mashak](/assets/img/avatar_default.png)
When application fails to pass flags in netlink TLV for a new skbedit action,
the kernel results in the following oops:
[ 8.307732] BUG: unable to handle kernel paging request at 0000000000021130
[ 8.309167] PGD 80000000193d1067 P4D 80000000193d1067 PUD 180e0067 PMD 0
[ 8.310595] Oops: 0000 [#1] SMP PTI
[ 8.311334] Modules linked in: kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper serio_raw
[ 8.314190] CPU: 1 PID: 397 Comm: tc Not tainted 4.17.0-rc3+ #357
[ 8.315252] RIP: 0010:__tcf_idr_release+0x33/0x140
[ 8.316203] RSP: 0018:ffffa0718038f840 EFLAGS: 00010246
[ 8.317123] RAX: 0000000000000001 RBX: 0000000000021100 RCX: 0000000000000000
[ 8.319831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000021100
[ 8.321181] RBP: 0000000000000000 R08: 000000000004adf8 R09: 0000000000000122
[ 8.322645] R10: 0000000000000000 R11: ffffffff9e5b01ed R12: 0000000000000000
[ 8.324157] R13: ffffffff9e0d3cc0 R14: 0000000000000000 R15: 0000000000000000
[ 8.325590] FS: 00007f591292e700(0000) GS:ffff8fcf5bc40000(0000) knlGS:0000000000000000
[ 8.327001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.327987] CR2: 0000000000021130 CR3: 00000000180e6004 CR4: 00000000001606a0
[ 8.329289] Call Trace:
[ 8.329735] tcf_skbedit_init+0xa7/0xb0
[ 8.330423] tcf_action_init_1+0x362/0x410
[ 8.331139] ? try_to_wake_up+0x44/0x430
[ 8.331817] tcf_action_init+0x103/0x190
[ 8.332511] tc_ctl_action+0x11a/0x220
[ 8.333174] rtnetlink_rcv_msg+0x23d/0x2e0
[ 8.333902] ? _cond_resched+0x16/0x40
[ 8.334569] ? __kmalloc_node_track_caller+0x5b/0x2c0
[ 8.335440] ? rtnl_calcit.isra.31+0xf0/0xf0
[ 8.336178] netlink_rcv_skb+0xdb/0x110
[ 8.336855] netlink_unicast+0x167/0x220
[ 8.337550] netlink_sendmsg+0x2a7/0x390
[ 8.338258] sock_sendmsg+0x30/0x40
[ 8.338865] ___sys_sendmsg+0x2c5/0x2e0
[ 8.339531] ? pagecache_get_page+0x27/0x210
[ 8.340271] ? filemap_fault+0xa2/0x630
[ 8.340943] ? page_add_file_rmap+0x108/0x200
[ 8.341732] ? alloc_set_pte+0x2aa/0x530
[ 8.342573] ? finish_fault+0x4e/0x70
[ 8.343332] ? __handle_mm_fault+0xbc1/0x10d0
[ 8.344337] ? __sys_sendmsg+0x53/0x80
[ 8.345040] __sys_sendmsg+0x53/0x80
[ 8.345678] do_syscall_64+0x4f/0x100
[ 8.346339] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 8.347206] RIP: 0033:0x7f591191da67
[ 8.347831] RSP: 002b:00007fff745abd48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 8.349179] RAX: ffffffffffffffda RBX: 00007fff745abe70 RCX: 00007f591191da67
[ 8.350431] RDX: 0000000000000000 RSI: 00007fff745abdc0 RDI: 0000000000000003
[ 8.351659] RBP: 000000005af35251 R08: 0000000000000001 R09: 0000000000000000
[ 8.352922] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000
[ 8.354183] R13: 00007fff745afed0 R14: 0000000000000001 R15: 00000000006767c0
[ 8.355400] Code: 41 89 d4 53 89 f5 48 89 fb e8 aa 20 fd ff 85 c0 0f 84 ed 00
00 00 48 85 db 0f 84 cf 00 00 00 40 84 ed 0f 85 cd 00 00 00 45 84 e4 <8b> 53 30
74 0d 85 d2 b8 ff ff ff ff 0f 8f b3 00 00 00 8b 43 2c
[ 8.358699] RIP: __tcf_idr_release+0x33/0x140 RSP: ffffa0718038f840
[ 8.359770] CR2: 0000000000021130
[ 8.360438] ---[ end trace 60c66be45dfc14f0 ]---
The caller calls action's ->init() and passes pointer to "struct tc_action *a",
which later may be initialized to point at the existing action, otherwise
"struct tc_action *a" is still invalid, and therefore dereferencing it is an
error as happens in tcf_idr_release, where refcnt is decremented.
So in case of missing flags tcf_idr_release must be called only for
existing actions.
v2:
- prepare patch for net tree
Fixes: 5e1567aeb7
("net sched: skbedit action fix late binding")
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
275 lines
7.2 KiB
C
275 lines
7.2 KiB
C
/*
|
|
* Copyright (c) 2008, Intel Corporation.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms and conditions of the GNU General Public License,
|
|
* version 2, as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along with
|
|
* this program; if not, see <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Author: Alexander Duyck <alexander.h.duyck@intel.com>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/rtnetlink.h>
|
|
#include <net/netlink.h>
|
|
#include <net/pkt_sched.h>
|
|
|
|
#include <linux/tc_act/tc_skbedit.h>
|
|
#include <net/tc_act/tc_skbedit.h>
|
|
|
|
static unsigned int skbedit_net_id;
|
|
static struct tc_action_ops act_skbedit_ops;
|
|
|
|
static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
|
|
struct tcf_result *res)
|
|
{
|
|
struct tcf_skbedit *d = to_skbedit(a);
|
|
|
|
spin_lock(&d->tcf_lock);
|
|
tcf_lastuse_update(&d->tcf_tm);
|
|
bstats_update(&d->tcf_bstats, skb);
|
|
|
|
if (d->flags & SKBEDIT_F_PRIORITY)
|
|
skb->priority = d->priority;
|
|
if (d->flags & SKBEDIT_F_QUEUE_MAPPING &&
|
|
skb->dev->real_num_tx_queues > d->queue_mapping)
|
|
skb_set_queue_mapping(skb, d->queue_mapping);
|
|
if (d->flags & SKBEDIT_F_MARK) {
|
|
skb->mark &= ~d->mask;
|
|
skb->mark |= d->mark & d->mask;
|
|
}
|
|
if (d->flags & SKBEDIT_F_PTYPE)
|
|
skb->pkt_type = d->ptype;
|
|
|
|
spin_unlock(&d->tcf_lock);
|
|
return d->tcf_action;
|
|
}
|
|
|
|
static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
|
|
[TCA_SKBEDIT_PARMS] = { .len = sizeof(struct tc_skbedit) },
|
|
[TCA_SKBEDIT_PRIORITY] = { .len = sizeof(u32) },
|
|
[TCA_SKBEDIT_QUEUE_MAPPING] = { .len = sizeof(u16) },
|
|
[TCA_SKBEDIT_MARK] = { .len = sizeof(u32) },
|
|
[TCA_SKBEDIT_PTYPE] = { .len = sizeof(u16) },
|
|
[TCA_SKBEDIT_MASK] = { .len = sizeof(u32) },
|
|
};
|
|
|
|
static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
|
|
struct nlattr *est, struct tc_action **a,
|
|
int ovr, int bind, struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, skbedit_net_id);
|
|
struct nlattr *tb[TCA_SKBEDIT_MAX + 1];
|
|
struct tc_skbedit *parm;
|
|
struct tcf_skbedit *d;
|
|
u32 flags = 0, *priority = NULL, *mark = NULL, *mask = NULL;
|
|
u16 *queue_mapping = NULL, *ptype = NULL;
|
|
bool exists = false;
|
|
int ret = 0, err;
|
|
|
|
if (nla == NULL)
|
|
return -EINVAL;
|
|
|
|
err = nla_parse_nested(tb, TCA_SKBEDIT_MAX, nla, skbedit_policy, NULL);
|
|
if (err < 0)
|
|
return err;
|
|
|
|
if (tb[TCA_SKBEDIT_PARMS] == NULL)
|
|
return -EINVAL;
|
|
|
|
if (tb[TCA_SKBEDIT_PRIORITY] != NULL) {
|
|
flags |= SKBEDIT_F_PRIORITY;
|
|
priority = nla_data(tb[TCA_SKBEDIT_PRIORITY]);
|
|
}
|
|
|
|
if (tb[TCA_SKBEDIT_QUEUE_MAPPING] != NULL) {
|
|
flags |= SKBEDIT_F_QUEUE_MAPPING;
|
|
queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
|
|
}
|
|
|
|
if (tb[TCA_SKBEDIT_PTYPE] != NULL) {
|
|
ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]);
|
|
if (!skb_pkt_type_ok(*ptype))
|
|
return -EINVAL;
|
|
flags |= SKBEDIT_F_PTYPE;
|
|
}
|
|
|
|
if (tb[TCA_SKBEDIT_MARK] != NULL) {
|
|
flags |= SKBEDIT_F_MARK;
|
|
mark = nla_data(tb[TCA_SKBEDIT_MARK]);
|
|
}
|
|
|
|
if (tb[TCA_SKBEDIT_MASK] != NULL) {
|
|
flags |= SKBEDIT_F_MASK;
|
|
mask = nla_data(tb[TCA_SKBEDIT_MASK]);
|
|
}
|
|
|
|
parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
|
|
|
|
exists = tcf_idr_check(tn, parm->index, a, bind);
|
|
if (exists && bind)
|
|
return 0;
|
|
|
|
if (!flags) {
|
|
if (exists)
|
|
tcf_idr_release(*a, bind);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (!exists) {
|
|
ret = tcf_idr_create(tn, parm->index, est, a,
|
|
&act_skbedit_ops, bind, false);
|
|
if (ret)
|
|
return ret;
|
|
|
|
d = to_skbedit(*a);
|
|
ret = ACT_P_CREATED;
|
|
} else {
|
|
d = to_skbedit(*a);
|
|
tcf_idr_release(*a, bind);
|
|
if (!ovr)
|
|
return -EEXIST;
|
|
}
|
|
|
|
spin_lock_bh(&d->tcf_lock);
|
|
|
|
d->flags = flags;
|
|
if (flags & SKBEDIT_F_PRIORITY)
|
|
d->priority = *priority;
|
|
if (flags & SKBEDIT_F_QUEUE_MAPPING)
|
|
d->queue_mapping = *queue_mapping;
|
|
if (flags & SKBEDIT_F_MARK)
|
|
d->mark = *mark;
|
|
if (flags & SKBEDIT_F_PTYPE)
|
|
d->ptype = *ptype;
|
|
/* default behaviour is to use all the bits */
|
|
d->mask = 0xffffffff;
|
|
if (flags & SKBEDIT_F_MASK)
|
|
d->mask = *mask;
|
|
|
|
d->tcf_action = parm->action;
|
|
|
|
spin_unlock_bh(&d->tcf_lock);
|
|
|
|
if (ret == ACT_P_CREATED)
|
|
tcf_idr_insert(tn, *a);
|
|
return ret;
|
|
}
|
|
|
|
static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
|
|
int bind, int ref)
|
|
{
|
|
unsigned char *b = skb_tail_pointer(skb);
|
|
struct tcf_skbedit *d = to_skbedit(a);
|
|
struct tc_skbedit opt = {
|
|
.index = d->tcf_index,
|
|
.refcnt = d->tcf_refcnt - ref,
|
|
.bindcnt = d->tcf_bindcnt - bind,
|
|
.action = d->tcf_action,
|
|
};
|
|
struct tcf_t t;
|
|
|
|
if (nla_put(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt))
|
|
goto nla_put_failure;
|
|
if ((d->flags & SKBEDIT_F_PRIORITY) &&
|
|
nla_put_u32(skb, TCA_SKBEDIT_PRIORITY, d->priority))
|
|
goto nla_put_failure;
|
|
if ((d->flags & SKBEDIT_F_QUEUE_MAPPING) &&
|
|
nla_put_u16(skb, TCA_SKBEDIT_QUEUE_MAPPING, d->queue_mapping))
|
|
goto nla_put_failure;
|
|
if ((d->flags & SKBEDIT_F_MARK) &&
|
|
nla_put_u32(skb, TCA_SKBEDIT_MARK, d->mark))
|
|
goto nla_put_failure;
|
|
if ((d->flags & SKBEDIT_F_PTYPE) &&
|
|
nla_put_u16(skb, TCA_SKBEDIT_PTYPE, d->ptype))
|
|
goto nla_put_failure;
|
|
if ((d->flags & SKBEDIT_F_MASK) &&
|
|
nla_put_u32(skb, TCA_SKBEDIT_MASK, d->mask))
|
|
goto nla_put_failure;
|
|
|
|
tcf_tm_dump(&t, &d->tcf_tm);
|
|
if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD))
|
|
goto nla_put_failure;
|
|
return skb->len;
|
|
|
|
nla_put_failure:
|
|
nlmsg_trim(skb, b);
|
|
return -1;
|
|
}
|
|
|
|
static int tcf_skbedit_walker(struct net *net, struct sk_buff *skb,
|
|
struct netlink_callback *cb, int type,
|
|
const struct tc_action_ops *ops,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, skbedit_net_id);
|
|
|
|
return tcf_generic_walker(tn, skb, cb, type, ops, extack);
|
|
}
|
|
|
|
static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, skbedit_net_id);
|
|
|
|
return tcf_idr_search(tn, a, index);
|
|
}
|
|
|
|
static struct tc_action_ops act_skbedit_ops = {
|
|
.kind = "skbedit",
|
|
.type = TCA_ACT_SKBEDIT,
|
|
.owner = THIS_MODULE,
|
|
.act = tcf_skbedit,
|
|
.dump = tcf_skbedit_dump,
|
|
.init = tcf_skbedit_init,
|
|
.walk = tcf_skbedit_walker,
|
|
.lookup = tcf_skbedit_search,
|
|
.size = sizeof(struct tcf_skbedit),
|
|
};
|
|
|
|
static __net_init int skbedit_init_net(struct net *net)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, skbedit_net_id);
|
|
|
|
return tc_action_net_init(tn, &act_skbedit_ops);
|
|
}
|
|
|
|
static void __net_exit skbedit_exit_net(struct list_head *net_list)
|
|
{
|
|
tc_action_net_exit(net_list, skbedit_net_id);
|
|
}
|
|
|
|
static struct pernet_operations skbedit_net_ops = {
|
|
.init = skbedit_init_net,
|
|
.exit_batch = skbedit_exit_net,
|
|
.id = &skbedit_net_id,
|
|
.size = sizeof(struct tc_action_net),
|
|
};
|
|
|
|
MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
|
|
MODULE_DESCRIPTION("SKB Editing");
|
|
MODULE_LICENSE("GPL");
|
|
|
|
static int __init skbedit_init_module(void)
|
|
{
|
|
return tcf_register_action(&act_skbedit_ops, &skbedit_net_ops);
|
|
}
|
|
|
|
static void __exit skbedit_cleanup_module(void)
|
|
{
|
|
tcf_unregister_action(&act_skbedit_ops, &skbedit_net_ops);
|
|
}
|
|
|
|
module_init(skbedit_init_module);
|
|
module_exit(skbedit_cleanup_module);
|