| Message ID | 1438301541-26192-2-git-send-email-xiyou.wangcong@gmail.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On 07/31/2015 02:12 AM, Cong Wang wrote: > When we share an action within a filter, the bind refcnt > should increase, therefore we should not call tcf_hash_release(). > > Cc: Jamal Hadi Salim <jhs@mojatatu.com> > Cc: Daniel Borkmann <daniel@iogearbox.net> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> > Signed-off-by: Cong Wang <cwang@twopensource.com> Seems like this slipped in via commit 1a29321ed045. The ugly thing is that this leads to a use-after-free. # tc actions add action pedit munge offset 2 u16 at 0 0f0000000 22 set 11500 # tc actions show action pedit action order 0: pedit action pass keys 1 index 1 ref 1 bind 0 key #0 at 0: val 00002cec mask ffff0000 # tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action pedit index 1 # tc filter show dev foo filter parent 1: protocol all pref 49152 bpf filter parent 1: protocol all pref 49152 bpf handle 0x1 flowid 1:1 bytecode '1,6 0 0 4294967295' action order 1: pedit action pass keys 1 index 1 ref 1 bind 0 key #0 at 0: val 00002cec mask ffff0000 # tc actions del action pedit index 1 .... and now you can wait for the next egress packet. ;) Thanks for the fix Cong! Fixes: 1a29321ed045 ("net_sched: act: Dont increment refcnt on replace") Acked-by: Daniel Borkmann <daniel@iogearbox.net> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Thu, 30 Jul 2015 17:12:21 -0700 > When we share an action within a filter, the bind refcnt > should increase, therefore we should not call tcf_hash_release(). > > Cc: Jamal Hadi Salim <jhs@mojatatu.com> > Cc: Daniel Borkmann <daniel@iogearbox.net> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> > Signed-off-by: Cong Wang <cwang@twopensource.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index 17e6d66..ff8b466 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c @@ -68,13 +68,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, } ret = ACT_P_CREATED; } else { - p = to_pedit(a); - tcf_hash_release(a, bind); if (bind) return 0; + tcf_hash_release(a, bind); if (!ovr) return -EEXIST; - + p = to_pedit(a); if (p->tcfp_nkeys && p->tcfp_nkeys != parm->nkeys) { keys = kmalloc(ksize, GFP_KERNEL); if (keys == NULL)