Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/807537/?format=api
{ "id": 807537, "url": "http://patchwork.ozlabs.org/api/patches/807537/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/patch/1504086545-7777-2-git-send-email-nikolay@cumulusnetworks.com/", "project": { "id": 7, "url": "http://patchwork.ozlabs.org/api/projects/7/?format=api", "name": "Linux network development", "link_name": "netdev", "list_id": "netdev.vger.kernel.org", "list_email": "netdev@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1504086545-7777-2-git-send-email-nikolay@cumulusnetworks.com>", "list_archive_url": null, "date": "2017-08-30T09:48:57", "name": "[net,1/9] sch_htb: fix crash on init failure", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "e107ef0f53653f9b515f978e8a629d7f2a19d920", "submitter": { "id": 66448, "url": "http://patchwork.ozlabs.org/api/people/66448/?format=api", "name": "Nikolay Aleksandrov", "email": "nikolay@cumulusnetworks.com" }, "delegate": { "id": 34, "url": "http://patchwork.ozlabs.org/api/users/34/?format=api", "username": "davem", "first_name": "David", "last_name": "Miller", "email": "davem@davemloft.net" }, "mbox": "http://patchwork.ozlabs.org/project/netdev/patch/1504086545-7777-2-git-send-email-nikolay@cumulusnetworks.com/mbox/", "series": [ { "id": 565, "url": "http://patchwork.ozlabs.org/api/series/565/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/list/?series=565", "date": "2017-08-30T09:48:56", "name": "net/sched: init failure fixes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/565/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/807537/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/807537/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<netdev-owner@vger.kernel.org>", "X-Original-To": "patchwork-incoming@ozlabs.org", "Delivered-To": "patchwork-incoming@ozlabs.org", "Authentication-Results": [ "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)", "ozlabs.org; dkim=pass (1024-bit key;\n\tunprotected) header.d=cumulusnetworks.com\n\theader.i=@cumulusnetworks.com header.b=\"gQHrEYDP\"; \n\tdkim-atps=neutral" ], "Received": [ "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xj11d1bdHz9sNn\n\tfor <patchwork-incoming@ozlabs.org>;\n\tWed, 30 Aug 2017 19:49:25 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751914AbdH3JtW (ORCPT <rfc822;patchwork-incoming@ozlabs.org>);\n\tWed, 30 Aug 2017 05:49:22 -0400", "from mail-wr0-f177.google.com ([209.85.128.177]:36803 \"EHLO\n\tmail-wr0-f177.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751319AbdH3JtV (ORCPT\n\t<rfc822;netdev@vger.kernel.org>); Wed, 30 Aug 2017 05:49:21 -0400", "by mail-wr0-f177.google.com with SMTP id p14so17018890wrg.3\n\tfor <netdev@vger.kernel.org>; Wed, 30 Aug 2017 02:49:20 -0700 (PDT)", "from debil.mediahub-bg.com (46-10-142-144.ip.btc-net.bg.\n\t[46.10.142.144]) by smtp.gmail.com with ESMTPSA id\n\to206sm1113294wmo.10.2017.08.30.02.49.17\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);\n\tWed, 30 Aug 2017 02:49:17 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=cumulusnetworks.com; s=google;\n\th=from:to:cc:subject:date:message-id:in-reply-to:references;\n\tbh=IVjIbn++Q6BA2f/9JLM8sbpsjnI7dXzqFHkiWqt9jBE=;\n\tb=gQHrEYDPborbJ36wWQnsnr9iw+6jIg9Zh5/7u6odo0m4LauPV90Nhh3OAsQ8wYHWih\n\taKb1OUPrR/qZhLOYZ40O+fvGiVoY9WQrq5e34ob8ugm03sd0EuEjaEap0tjjLWp0aop4\n\tMzoAM+JsAenn+FY1eSeQNAHqzYnxHQZiK5DPg=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references;\n\tbh=IVjIbn++Q6BA2f/9JLM8sbpsjnI7dXzqFHkiWqt9jBE=;\n\tb=a/eEOZowIt1XPgDqUlLHQSlXh5cZn5+iMUQxjvV2zv+kKfpN2iIO4FqKIp0F1AIq+/\n\t2OVsdrUZERzlS0yk4DCJEYSWU/MxYJKCoUpLHc8viQkeSawym8V/7ufwx+hWfbZTSXUA\n\tFZOytpJ3nrQmJ1SMTfEvNZuOqCcZM2iTpWOADNY0UhE9l+lHQIUUVm+EJFbzm85xWg41\n\ttaE0Xh6XQuRpRAjWZPHf7w/alaMmjBjEI4krnC8greJsokRsswaSia+CgtGrsJ3ao2M7\n\tZoilIUw7aFNHlotb/wrgnROhRMkS/KO5ccHIqOz7IMcYbLHEg3zgNHW5pX+JDPnSwL63\n\tCnKg==", "X-Gm-Message-State": "AHYfb5jf03CDJAl38lvUbD2v3yUGB/jvu0RUuJZXk6D5dc7Bv3wRY+qu\n\t2SNTZAUN9YnzOVknYKA=", "X-Received": "by 10.223.198.81 with SMTP id u17mr643097wrg.117.1504086559292; \n\tWed, 30 Aug 2017 02:49:19 -0700 (PDT)", "From": "Nikolay Aleksandrov <nikolay@cumulusnetworks.com>", "To": "netdev@vger.kernel.org", "Cc": "edumazet@google.com, jhs@mojatatu.com, xiyou.wangcong@gmail.com,\n\tjiri@resnulli.us, roopa@cumulusnetworks.com,\n\tNikolay Aleksandrov <nikolay@cumulusnetworks.com>", "Subject": "[PATCH net 1/9] sch_htb: fix crash on init failure", "Date": "Wed, 30 Aug 2017 12:48:57 +0300", "Message-Id": "<1504086545-7777-2-git-send-email-nikolay@cumulusnetworks.com>", "X-Mailer": "git-send-email 2.1.4", "In-Reply-To": "<1504086545-7777-1-git-send-email-nikolay@cumulusnetworks.com>", "References": "<1504086545-7777-1-git-send-email-nikolay@cumulusnetworks.com>", "Sender": "netdev-owner@vger.kernel.org", "Precedence": "bulk", "List-ID": "<netdev.vger.kernel.org>", "X-Mailing-List": "netdev@vger.kernel.org" }, "content": "The commit below added a call to the ->destroy() callback for all qdiscs\nwhich failed in their ->init(), but some were not prepared for such\nchange and can't handle partially initialized qdisc. HTB is one of them\nand if any error occurs before the qdisc watchdog timer and qdisc work are\ninitialized then we can hit either a null ptr deref (timer->base) when\ncanceling in ->destroy or lockdep error info about trying to register\na non-static key and a stack dump. So to fix these two move the watchdog\ntimer and workqueue init before anything that can err out.\nTo reproduce userspace needs to send broken htb qdisc create request,\ntested with a modified tc (q_htb.c).\n\nTrace log:\n[ 2710.897602] BUG: unable to handle kernel NULL pointer dereference at (null)\n[ 2710.897977] IP: hrtimer_active+0x17/0x8a\n[ 2710.898174] PGD 58fab067\n[ 2710.898175] P4D 58fab067\n[ 2710.898353] PUD 586c0067\n[ 2710.898531] PMD 0\n[ 2710.898710]\n[ 2710.899045] Oops: 0000 [#1] SMP\n[ 2710.899232] Modules linked in:\n[ 2710.899419] CPU: 1 PID: 950 Comm: tc Not tainted 4.13.0-rc6+ #54\n[ 2710.899646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014\n[ 2710.900035] task: ffff880059ed2700 task.stack: ffff88005ad4c000\n[ 2710.900262] RIP: 0010:hrtimer_active+0x17/0x8a\n[ 2710.900467] RSP: 0018:ffff88005ad4f960 EFLAGS: 00010246\n[ 2710.900684] RAX: 0000000000000000 RBX: ffff88003701e298 RCX: 0000000000000000\n[ 2710.900933] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003701e298\n[ 2710.901177] RBP: ffff88005ad4f980 R08: 0000000000000001 R09: 0000000000000001\n[ 2710.901419] R10: ffff88005ad4f800 R11: 0000000000000400 R12: 0000000000000000\n[ 2710.901663] R13: ffff88003701e298 R14: ffffffff822a4540 R15: ffff88005ad4fac0\n[ 2710.901907] FS: 00007f2f5e90f740(0000) GS:ffff88005d880000(0000) knlGS:0000000000000000\n[ 2710.902277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2710.902500] CR2: 0000000000000000 CR3: 0000000058ca3000 CR4: 00000000000406e0\n[ 2710.902744] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 2710.902977] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 2710.903180] Call Trace:\n[ 2710.903332] hrtimer_try_to_cancel+0x1a/0x93\n[ 2710.903504] hrtimer_cancel+0x15/0x20\n[ 2710.903667] qdisc_watchdog_cancel+0x12/0x14\n[ 2710.903866] htb_destroy+0x2e/0xf7\n[ 2710.904097] qdisc_create+0x377/0x3fd\n[ 2710.904330] tc_modify_qdisc+0x4d2/0x4fd\n[ 2710.904511] rtnetlink_rcv_msg+0x188/0x197\n[ 2710.904682] ? rcu_read_unlock+0x3e/0x5f\n[ 2710.904849] ? rtnl_newlink+0x729/0x729\n[ 2710.905017] netlink_rcv_skb+0x6c/0xce\n[ 2710.905183] rtnetlink_rcv+0x23/0x2a\n[ 2710.905345] netlink_unicast+0x103/0x181\n[ 2710.905511] netlink_sendmsg+0x326/0x337\n[ 2710.905679] sock_sendmsg_nosec+0x14/0x3f\n[ 2710.905847] sock_sendmsg+0x29/0x2e\n[ 2710.906010] ___sys_sendmsg+0x209/0x28b\n[ 2710.906176] ? do_raw_spin_unlock+0xcd/0xf8\n[ 2710.906346] ? _raw_spin_unlock+0x27/0x31\n[ 2710.906514] ? __handle_mm_fault+0x651/0xdb1\n[ 2710.906685] ? check_chain_key+0xb0/0xfd\n[ 2710.906855] __sys_sendmsg+0x45/0x63\n[ 2710.907018] ? __sys_sendmsg+0x45/0x63\n[ 2710.907185] SyS_sendmsg+0x19/0x1b\n[ 2710.907344] entry_SYSCALL_64_fastpath+0x23/0xc2\n\nNote that probably this bug goes further back because the default qdisc\nhandling always calls ->destroy on init failure too.\n\nFixes: 87b60cfacf9f (\"net_sched: fix error recovery at qdisc creation\")\nFixes: 0fbbeb1ba43b (\"[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()\")\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\n---\n net/sched/sch_htb.c | 5 +++--\n 1 file changed, 3 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c\nindex 5d65ec5207e9..5bf5177b2bd3 100644\n--- a/net/sched/sch_htb.c\n+++ b/net/sched/sch_htb.c\n@@ -1017,6 +1017,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)\n \tint err;\n \tint i;\n \n+\tqdisc_watchdog_init(&q->watchdog, sch);\n+\tINIT_WORK(&q->work, htb_work_func);\n+\n \tif (!opt)\n \t\treturn -EINVAL;\n \n@@ -1041,8 +1044,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)\n \tfor (i = 0; i < TC_HTB_NUMPRIO; i++)\n \t\tINIT_LIST_HEAD(q->drops + i);\n \n-\tqdisc_watchdog_init(&q->watchdog, sch);\n-\tINIT_WORK(&q->work, htb_work_func);\n \tqdisc_skb_head_init(&q->direct_queue);\n \n \tif (tb[TCA_HTB_DIRECT_QLEN])\n", "prefixes": [ "net", "1/9" ] }