From patchwork Tue Dec 1 14:15:37 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 550908 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 8CE25140216 for ; Wed, 2 Dec 2015 01:15:44 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=smR89dms; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755237AbbLAOPk (ORCPT ); Tue, 1 Dec 2015 09:15:40 -0500 Received: from mail-pa0-f48.google.com ([209.85.220.48]:35455 "EHLO mail-pa0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754336AbbLAOPj (ORCPT ); Tue, 1 Dec 2015 09:15:39 -0500 Received: by pacej9 with SMTP id ej9so6561749pac.2 for ; Tue, 01 Dec 2015 06:15:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:subject:from:to:cc:date:in-reply-to:references :content-type:mime-version:content-transfer-encoding; bh=DNK/iDakAEVgtlxzA34GIAnOId15yrhnEI8drBIqCic=; b=smR89dmstUAyCxuG64mkm77tq8O79flrujKul2AE1qtyy9Guo41XMY9K1uZXyLCuVH dtasRjfTONrLGrSKbLmEUTof/S06eJfmNpL6Os1KVggUpKVEDkNv4RLc+FIFiqG4dNkk /ILycKKskEetXlidBXITQD242p7olfMKo4WVsGmSt5ZoNDXid5EfRqZXZ44Qm832KSIA yOQIBMoYSusSZYmAtQze8bVxKWBbzXMzzyoHQ4zoR/vGF2MvJtULDWdUAzKqd6inPkIx OEsQ80WQlus5hmHJvse+jcT7S4/u/qMzZ3DDsidXjGSo393xaTTRt/wRk6BEbU/HYkir FgTg== X-Received: by 10.98.14.26 with SMTP id w26mr80058184pfi.110.1448979338598; Tue, 01 Dec 2015 06:15:38 -0800 (PST) Received: from [172.26.54.208] ([172.26.54.208]) by smtp.gmail.com with ESMTPSA id v89sm42159862pfa.91.2015.12.01.06.15.37 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 01 Dec 2015 06:15:38 -0800 (PST) Message-ID: <1448979337.25582.22.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c From: Eric Dumazet To: Daniele Fucini Cc: Cong Wang , netdev , Jamal Hadi Salim , David Miller , spender@grsecurity.net, pageexec@freemail.hu, re.emese@gmail.com Date: Tue, 01 Dec 2015 06:15:37 -0800 In-Reply-To: <1448978807.25582.19.camel@edumazet-glaptop2.roam.corp.google.com> References: <20151201010005.GA23175@Fux-PC> <20151201111943.GA4036@Fux-PC> <1448978807.25582.19.camel@edumazet-glaptop2.roam.corp.google.com> X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: > > Thanks for the reply. Here's the output of `tc qdisc show`: > > https://gist.github.com/1847102c8fe08f63e9e7 > > > > Daniele > > > > > > On Mon, Nov 30, 2015 at 08:50:29PM -0800, Cong Wang wrote: > > > On Mon, Nov 30, 2015 at 5:00 PM, Daniele Fucini wrote: > > > > Hello, > > > > > > > > I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and > > > > I'm getting system freezes due to PaX detecting a size overflow in > > > > function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 whenever I use > > > > Transmission BitTorrent client. > > > > > > > > On the Grsecurity forum I was told it's probably an unintended integer > > > > underflow that I should report upstream. > > > > > > > > Here's the relevant log: > > > > https://gist.github.com/cf54ccbb12ea65e146d4 > > > > > > > > > > Looks like we miss some sch->q.qlen accounting somewhere... > > > > > > What is your qdisc setup? Is your fq_codel the default one or you installed it > > > or some other qdisc somewhere (`tc qdisc show` could tell)? > > > > > > I will take a deeper look tomorrow, or maybe Jamal could find something > > > before I wake up. ;) > > Hmm... I do not think we ever took care of MQ in > qdisc_tree_decrease_qlen() Please try following fix : --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index f43c8f33f09e..72f2c1dfdcde 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -759,6 +759,8 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n) WARN_ON(parentid != TC_H_ROOT); return; } + if (sch->flags & TCQ_F_MQROOT) + return; cops = sch->ops->cl_ops; if (cops->qlen_notify) { cl = cops->get(sch, parentid);