From patchwork Mon Sep 15 23:43:43 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cong Wang X-Patchwork-Id: 389856 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 9345314012B for ; Tue, 16 Sep 2014 09:43:57 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757053AbaIOXnx (ORCPT ); Mon, 15 Sep 2014 19:43:53 -0400 Received: from mail-pd0-f176.google.com ([209.85.192.176]:43494 "EHLO mail-pd0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757025AbaIOXnw (ORCPT ); Mon, 15 Sep 2014 19:43:52 -0400 Received: by mail-pd0-f176.google.com with SMTP id y13so7336297pdi.7 for ; Mon, 15 Sep 2014 16:43:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=GvCs+vudZroxkl5Y3d7us1HDyMC+LuW6r/zdWSUWx5g=; b=XyTtJnIli8uokJ9vpUtuHPhAO4LoNRWBVKB/PHNvUwpQob2UtGFGZGSgB494SNUXK4 yfOI3hXtYdOQb5Z7lYKJHKN9ct+fYiYsooViEXDOVIDJ2RwxN4TEhUOApj7xXmI1EKtX xjM5jZKPzf1jAbQqIjdmZU7aZlzSGyd64as+aLvq8YGY4in7MfUKRsSttcp8iq7WM148 DZ3vkBD7RL7sYoF5Rv15/Ewkw5xG6nShE7n1ySCesCoOtixUvZtdhyBo/9ojP9Vl6rfI MjrsPGKN7Gkxuw12pB4GFPyNGn+kqh5+u5siSFzPrvkjd5DkDp5IfNcpiIWYBktel9il PXcw== X-Received: by 10.70.54.193 with SMTP id l1mr8184065pdp.160.1410824631666; Mon, 15 Sep 2014 16:43:51 -0700 (PDT) Received: from localhost.net ([8.25.197.27]) by mx.google.com with ESMTPSA id bf2sm10902362pbb.13.2014.09.15.16.43.50 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 15 Sep 2014 16:43:50 -0700 (PDT) From: Cong Wang To: netdev@vger.kernel.org Cc: john.fastabend@gmail.com, "David S. Miller" , Cong Wang Subject: [Patch net-next] net_sched: fix a null pointer dereference in tcindex_set_parms() Date: Mon, 15 Sep 2014 16:43:43 -0700 Message-Id: <1410824623-27516-2-git-send-email-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1410824623-27516-1-git-send-email-xiyou.wangcong@gmail.com> References: <1410824623-27516-1-git-send-email-xiyou.wangcong@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch fixes the following crash: [ 42.199159] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 42.200027] IP: [] tcindex_set_parms+0x45c/0x526 [ 42.200027] PGD d2319067 PUD d4ffe067 PMD 0 [ 42.200027] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC [ 42.200027] CPU: 0 PID: 541 Comm: tc Not tainted 3.17.0-rc4+ #603 [ 42.200027] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 42.200027] task: ffff8800d22d2670 ti: ffff8800ce790000 task.ti: ffff8800ce790000 [ 42.200027] RIP: 0010:[] [] tcindex_set_parms+0x45c/0x526 [ 42.200027] RSP: 0018:ffff8800ce793898 EFLAGS: 00010202 [ 42.200027] RAX: 0000000000000001 RBX: ffff8800d1786498 RCX: 0000000000000000 [ 42.200027] RDX: ffffffff82114ec8 RSI: ffffffff82114ec8 RDI: ffffffff82114ec8 [ 42.200027] RBP: ffff8800ce793958 R08: 00000000000080d0 R09: 0000000000000001 [ 42.200027] R10: ffff8800ce7939a0 R11: 0000000000000246 R12: ffff8800d017d238 [ 42.200027] R13: 0000000000000018 R14: ffff8800d017c6a0 R15: ffff8800d1786620 [ 42.200027] FS: 00007f4e24539740(0000) GS:ffff88011a600000(0000) knlGS:0000000000000000 [ 42.200027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.200027] CR2: 0000000000000018 CR3: 00000000cff38000 CR4: 00000000000006f0 [ 42.200027] Stack: [ 42.200027] ffff8800ce0949f0 0000000000000000 0000000200000003 ffff880000000000 [ 42.200027] ffff8800ce7938b8 ffff8800ce7938b8 0000000600000007 0000000000000000 [ 42.200027] ffff8800ce7938d8 ffff8800ce7938d8 0000000600000007 ffff8800ce0949f0 [ 42.200027] Call Trace: [ 42.200027] [] tcindex_change+0xdb/0xee [ 42.200027] [] tc_ctl_tfilter+0x44d/0x63f [ 42.200027] [] rtnetlink_rcv_msg+0x181/0x194 [ 42.200027] [] ? rtnl_lock+0x17/0x19 [ 42.200027] [] ? __rtnl_unlock+0x17/0x17 [ 42.200027] [] netlink_rcv_skb+0x49/0x8b [ 43.462494] [] rtnetlink_rcv+0x23/0x2a [ 43.462494] [] netlink_unicast+0xc7/0x148 [ 43.462494] [] netlink_sendmsg+0x5cb/0x63d [ 43.462494] [] ? mark_lock+0x2e/0x224 [ 43.462494] [] __sock_sendmsg_nosec+0x25/0x27 [ 43.462494] [] sock_sendmsg+0x57/0x71 [ 43.462494] [] ? might_fault+0x57/0xa4 [ 43.462494] [] ? might_fault+0xa0/0xa4 [ 43.462494] [] ? might_fault+0x57/0xa4 [ 43.462494] [] ? verify_iovec+0x69/0xb7 [ 43.462494] [] ___sys_sendmsg+0x21d/0x2bb [ 43.462494] [] ? native_sched_clock+0x35/0x37 [ 43.462494] [] ? sched_clock_local+0x12/0x72 [ 43.462494] [] ? mark_lock+0x2e/0x224 [ 43.462494] [] ? sched_clock_cpu+0xa0/0xb9 [ 43.462494] [] ? __lock_acquire+0x5fe/0xde4 [ 43.462494] [] ? rcu_read_lock_held+0x36/0x38 [ 43.462494] [] ? __fcheck_files.isra.7+0x4b/0x57 [ 43.462494] [] ? __fget_light+0x30/0x54 [ 43.462494] [] __sys_sendmsg+0x42/0x60 [ 43.462494] [] SyS_sendmsg+0x12/0x1c [ 43.462494] [] system_call_fastpath+0x16/0x1b 'p->h' could be NULL while 'cp->h' is always update to date. Fixes: commit 331b72922c5f58d48fd ("net: sched: RCU cls_tcindex") Cc: John Fastabend Signed-off-by: Cong Wang Acked-By: John Fastabend --- net/sched/cls_tcindex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c index ee52542..5054fae 100644 --- a/net/sched/cls_tcindex.c +++ b/net/sched/cls_tcindex.c @@ -381,7 +381,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, f->result = new_filter_result; f->next = NULL; - fp = p->h + (handle % p->hash); + fp = cp->h + (handle % cp->hash); for (nfp = rtnl_dereference(*fp); nfp; fp = &nfp->next, nfp = rtnl_dereference(*fp))