Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/807213/?format=api
{ "id": 807213, "url": "http://patchwork.ozlabs.org/api/patches/807213/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/patch/1504029487-7085-1-git-send-email-nikolay@cumulusnetworks.com/", "project": { "id": 7, "url": "http://patchwork.ozlabs.org/api/projects/7/?format=api", "name": "Linux network development", "link_name": "netdev", "list_id": "netdev.vger.kernel.org", "list_email": "netdev@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1504029487-7085-1-git-send-email-nikolay@cumulusnetworks.com>", "list_archive_url": null, "date": "2017-08-29T17:58:07", "name": "[net] sch_htb: fix crash on init failure", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "e107ef0f53653f9b515f978e8a629d7f2a19d920", "submitter": { "id": 66448, "url": "http://patchwork.ozlabs.org/api/people/66448/?format=api", "name": "Nikolay Aleksandrov", "email": "nikolay@cumulusnetworks.com" }, "delegate": { "id": 34, "url": "http://patchwork.ozlabs.org/api/users/34/?format=api", "username": "davem", "first_name": "David", "last_name": "Miller", "email": "davem@davemloft.net" }, "mbox": "http://patchwork.ozlabs.org/project/netdev/patch/1504029487-7085-1-git-send-email-nikolay@cumulusnetworks.com/mbox/", "series": [ { "id": 426, "url": "http://patchwork.ozlabs.org/api/series/426/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/list/?series=426", "date": "2017-08-29T17:58:07", "name": "[net] sch_htb: fix crash on init failure", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/426/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/807213/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/807213/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<netdev-owner@vger.kernel.org>", "X-Original-To": "patchwork-incoming@ozlabs.org", "Delivered-To": "patchwork-incoming@ozlabs.org", "Authentication-Results": [ "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)", "ozlabs.org; dkim=pass (1024-bit key;\n\tunprotected) header.d=cumulusnetworks.com\n\theader.i=@cumulusnetworks.com header.b=\"Iofs3hCA\"; \n\tdkim-atps=neutral" ], "Received": [ "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xhbwK5ncbz9s81\n\tfor <patchwork-incoming@ozlabs.org>;\n\tWed, 30 Aug 2017 03:58:25 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751238AbdH2R6X (ORCPT <rfc822;patchwork-incoming@ozlabs.org>);\n\tTue, 29 Aug 2017 13:58:23 -0400", "from mail-wm0-f48.google.com ([74.125.82.48]:37153 \"EHLO\n\tmail-wm0-f48.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1750822AbdH2R6W (ORCPT\n\t<rfc822;netdev@vger.kernel.org>); Tue, 29 Aug 2017 13:58:22 -0400", "by mail-wm0-f48.google.com with SMTP id u26so2499153wma.0\n\tfor <netdev@vger.kernel.org>; Tue, 29 Aug 2017 10:58:21 -0700 (PDT)", "from debil.mediahub-bg.com (46-10-142-144.ip.btc-net.bg.\n\t[46.10.142.144]) by smtp.gmail.com with ESMTPSA id\n\tp65sm245098wmg.44.2017.08.29.10.58.19\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);\n\tTue, 29 Aug 2017 10:58:19 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=cumulusnetworks.com; s=google;\n\th=from:to:cc:subject:date:message-id;\n\tbh=KU3Epnd2U5ZxiH59X4x8T1ELKWJs3fO8DEOmVjeq928=;\n\tb=Iofs3hCAocG1frMkaVQnW3IC/A58OeoBKh0NZRnUdqBqW5mwqPjVmRcC6p+0ZAA6N9\n\tWvKAh8l23BlzQcd6NKABaFu9lA6QbUOdfL7pF+qpbEki0rMC6Md1pIUuENToJVeccv1M\n\tU3XJQuS2HlIck62QEyzJ9Krr7hQCU6QR9+phk=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id;\n\tbh=KU3Epnd2U5ZxiH59X4x8T1ELKWJs3fO8DEOmVjeq928=;\n\tb=gCl3t9zcKfUfWumUb1hDD5sunPC88tzspYxVhGM0KxYwm8V111fUjEWpcIl3d/4Qhm\n\tVODAi4ABpDwEO2BEC/MJZ/O0MQ8/2bKtBXVw98o2qZSDfaan6W+TUsNbR8p3QKcIu4uR\n\t0siJUanrIPdyEprfeKVJPXGqrtFtW6+YBkqzSsF3kEJF9uCAY1d68Y/iC4EJMLtr0xta\n\tEdJldGyxAlYy9GrxVwZ62Kpc4pDUy1C3Rjs1Xu/YAlGL8yDpTg+VNda50zXyUC7gm9Nc\n\tJSkjYTI807GX0TQrb9DeT/8JDWQhW6BuMCTafnDii4K9D4zHEP3oXvUL11W/72AoBTNa\n\t8WWw==", "X-Gm-Message-State": "AHYfb5jIPd5AghziqsQighkkh6gaNBJmAd3NeOh7A0sdzUO1IpxDKVAn\n\t1Rr9f3f+b7twW6JNJ/c=", "X-Received": "by 10.28.28.198 with SMTP id c189mr182501wmc.73.1504029500634;\n\tTue, 29 Aug 2017 10:58:20 -0700 (PDT)", "From": "Nikolay Aleksandrov <nikolay@cumulusnetworks.com>", "To": "netdev@vger.kernel.org", "Cc": "edumazet@google.com, jhs@mojatatu.com, xiyou.wangcong@gmail.com,\n\tjiri@resnulli.us, roopa@cumulusnetworks.com,\n\tNikolay Aleksandrov <nikolay@cumulusnetworks.com>", "Subject": "[PATCH net] sch_htb: fix crash on init failure", "Date": "Tue, 29 Aug 2017 20:58:07 +0300", "Message-Id": "<1504029487-7085-1-git-send-email-nikolay@cumulusnetworks.com>", "X-Mailer": "git-send-email 2.1.4", "Sender": "netdev-owner@vger.kernel.org", "Precedence": "bulk", "List-ID": "<netdev.vger.kernel.org>", "X-Mailing-List": "netdev@vger.kernel.org" }, "content": "The commit below added a call to the ->destroy() callback for all qdiscs\nwhich failed in their ->init(), but some were not prepared for such\nchange and can't handle partially initialized qdisc. HTB is one of them\nand if any error occurs before the qdisc watchdog timer and qdisc work are\ninitialized then we can hit either a null ptr deref (timer->base) when\ncanceling in ->destroy or lockdep error info about trying to register\na non-static key and a stack dump. So to fix these two move the watchdog\ntimer and workqueue init before anything that can err out.\nTo reproduce userspace needs to send broken htb qdisc create request,\ntested with a modified tc (q_htb.c).\n\nTrace log:\n[ 2710.897602] BUG: unable to handle kernel NULL pointer dereference at (null)\n[ 2710.897977] IP: hrtimer_active+0x17/0x8a\n[ 2710.898174] PGD 58fab067\n[ 2710.898175] P4D 58fab067\n[ 2710.898353] PUD 586c0067\n[ 2710.898531] PMD 0\n[ 2710.898710]\n[ 2710.899045] Oops: 0000 [#1] SMP\n[ 2710.899232] Modules linked in:\n[ 2710.899419] CPU: 1 PID: 950 Comm: tc Not tainted 4.13.0-rc6+ #54\n[ 2710.899646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014\n[ 2710.900035] task: ffff880059ed2700 task.stack: ffff88005ad4c000\n[ 2710.900262] RIP: 0010:hrtimer_active+0x17/0x8a\n[ 2710.900467] RSP: 0018:ffff88005ad4f960 EFLAGS: 00010246\n[ 2710.900684] RAX: 0000000000000000 RBX: ffff88003701e298 RCX: 0000000000000000\n[ 2710.900933] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003701e298\n[ 2710.901177] RBP: ffff88005ad4f980 R08: 0000000000000001 R09: 0000000000000001\n[ 2710.901419] R10: ffff88005ad4f800 R11: 0000000000000400 R12: 0000000000000000\n[ 2710.901663] R13: ffff88003701e298 R14: ffffffff822a4540 R15: ffff88005ad4fac0\n[ 2710.901907] FS: 00007f2f5e90f740(0000) GS:ffff88005d880000(0000) knlGS:0000000000000000\n[ 2710.902277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2710.902500] CR2: 0000000000000000 CR3: 0000000058ca3000 CR4: 00000000000406e0\n[ 2710.902744] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 2710.902977] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 2710.903180] Call Trace:\n[ 2710.903332] hrtimer_try_to_cancel+0x1a/0x93\n[ 2710.903504] hrtimer_cancel+0x15/0x20\n[ 2710.903667] qdisc_watchdog_cancel+0x12/0x14\n[ 2710.903866] htb_destroy+0x2e/0xf7\n[ 2710.904097] qdisc_create+0x377/0x3fd\n[ 2710.904330] tc_modify_qdisc+0x4d2/0x4fd\n[ 2710.904511] rtnetlink_rcv_msg+0x188/0x197\n[ 2710.904682] ? rcu_read_unlock+0x3e/0x5f\n[ 2710.904849] ? rtnl_newlink+0x729/0x729\n[ 2710.905017] netlink_rcv_skb+0x6c/0xce\n[ 2710.905183] rtnetlink_rcv+0x23/0x2a\n[ 2710.905345] netlink_unicast+0x103/0x181\n[ 2710.905511] netlink_sendmsg+0x326/0x337\n[ 2710.905679] sock_sendmsg_nosec+0x14/0x3f\n[ 2710.905847] sock_sendmsg+0x29/0x2e\n[ 2710.906010] ___sys_sendmsg+0x209/0x28b\n[ 2710.906176] ? do_raw_spin_unlock+0xcd/0xf8\n[ 2710.906346] ? _raw_spin_unlock+0x27/0x31\n[ 2710.906514] ? __handle_mm_fault+0x651/0xdb1\n[ 2710.906685] ? check_chain_key+0xb0/0xfd\n[ 2710.906855] __sys_sendmsg+0x45/0x63\n[ 2710.907018] ? __sys_sendmsg+0x45/0x63\n[ 2710.907185] SyS_sendmsg+0x19/0x1b\n[ 2710.907344] entry_SYSCALL_64_fastpath+0x23/0xc2\n\nNote that probably this bug goes further back because the default qdisc\nhandling always calls ->destroy on init failure too.\n\nFixes: 87b60cfacf9f (\"net_sched: fix error recovery at qdisc creation\")\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\n---\nAlways calling qdisc destroy on init failure in the default qdisc handling\nwas added in commit 0fbbeb1ba43b. I'm not sure if I should include that\none as fixes tag.\n\nThere're more fixes to come, some are much easier to trigger without\nmodifications to tc.\n\n net/sched/sch_htb.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c\nindex 5d65ec5207e9..5bf5177b2bd3 100644\n--- a/net/sched/sch_htb.c\n+++ b/net/sched/sch_htb.c\n@@ -1017,6 +1017,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)\n \tint err;\n \tint i;\n \n+\tqdisc_watchdog_init(&q->watchdog, sch);\n+\tINIT_WORK(&q->work, htb_work_func);\n+\n \tif (!opt)\n \t\treturn -EINVAL;\n \n@@ -1041,8 +1044,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)\n \tfor (i = 0; i < TC_HTB_NUMPRIO; i++)\n \t\tINIT_LIST_HEAD(q->drops + i);\n \n-\tqdisc_watchdog_init(&q->watchdog, sch);\n-\tINIT_WORK(&q->work, htb_work_func);\n \tqdisc_skb_head_init(&q->direct_queue);\n \n \tif (tb[TCA_HTB_DIRECT_QLEN])\n", "prefixes": [ "net" ] }