Message ID | 094e34b7e8d45a323c5cf18a366665654b3f3e45.1437163466.git.daniel@iogearbox.net |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
On 15-07-17 01:38 PM, Daniel Borkmann wrote: > The following test case causes a NULL pointer dereference in cls_bpf: > > FOO="1,6 0 0 4294967295," > tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok > tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ > bpf bytecode "$FOO" flowid 1:1 action drop > > The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") > accidentally swapped the arguments of list_replace_rcu(), the old > element needs to be the first argument and the new element the second. > > Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") > Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> > --- Thanks Daniel. Apparently I got this right in cls_basic but botched it here and in cls_flow. FWIW, Acked-by: John Fastabend <john.r.fastabend@intel.com> > net/sched/cls_bpf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c > index c79ecfd..e5168f8 100644 > --- a/net/sched/cls_bpf.c > +++ b/net/sched/cls_bpf.c > @@ -378,7 +378,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, > goto errout; > > if (oldprog) { > - list_replace_rcu(&prog->link, &oldprog->link); > + list_replace_rcu(&oldprog->link, &prog->link); > tcf_unbind_filter(tp, &oldprog->res); > call_rcu(&oldprog->rcu, __cls_bpf_delete_prog); > } else { > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 07/17/2015 11:05 PM, John Fastabend wrote: ... > Thanks Daniel. Apparently I got this right in cls_basic but botched it > here and in cls_flow. Yep, it's correct there. :) Thanks, Daniel -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 7/17/15 2:05 PM, John Fastabend wrote: > On 15-07-17 01:38 PM, Daniel Borkmann wrote: >> >The following test case causes a NULL pointer dereference in cls_bpf: >> > >> > FOO="1,6 0 0 4294967295," >> > tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok >> > tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ >> > bpf bytecode "$FOO" flowid 1:1 action drop >> > >> >The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") >> >accidentally swapped the arguments of list_replace_rcu(), the old >> >element needs to be the first argument and the new element the second. >> > >> >Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") >> >Signed-off-by: Daniel Borkmann<daniel@iogearbox.net> >> >--- > Thanks Daniel. Apparently I got this right in cls_basic but botched it > here and in cls_flow. > > FWIW, > > Acked-by: John Fastabend<john.r.fastabend@intel.com> Thanks for the quick fix. Acked-by: Alexei Starovoitov <ast@plumgrid.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c index c79ecfd..e5168f8 100644 --- a/net/sched/cls_bpf.c +++ b/net/sched/cls_bpf.c @@ -378,7 +378,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, goto errout; if (oldprog) { - list_replace_rcu(&prog->link, &oldprog->link); + list_replace_rcu(&oldprog->link, &prog->link); tcf_unbind_filter(tp, &oldprog->res); call_rcu(&oldprog->rcu, __cls_bpf_delete_prog); } else {
The following test case causes a NULL pointer dereference in cls_bpf: FOO="1,6 0 0 4294967295," tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ bpf bytecode "$FOO" flowid 1:1 action drop The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") accidentally swapped the arguments of list_replace_rcu(), the old element needs to be the first argument and the new element the second. Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> --- net/sched/cls_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)