Message ID | 1581971889-5862-1-git-send-email-jbaron@akamai.com |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | [v3,net] net: sched: correct flower port blocking | expand |
From: Jason Baron <jbaron@akamai.com> Date: Mon, 17 Feb 2020 15:38:09 -0500 > tc flower rules that are based on src or dst port blocking are sometimes > ineffective due to uninitialized stack data. __skb_flow_dissect() extracts > ports from the skb for tc flower to match against. However, the port > dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in > key_control->flags. All callers of __skb_flow_dissect(), zero-out the > key_control field except for fl_classify() as used by the flower > classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to > __skb_flow_dissect(), since key_control is allocated on the stack > and may not be initialized. > > Since key_basic and key_control are present for all flow keys, let's > make sure they are initialized. > > Fixes: 62230715fd24 ("flow_dissector: do not dissect l4 ports for fragments") > Co-developed-by: Eric Dumazet <edumazet@google.com> > Signed-off-by: Eric Dumazet <edumazet@google.com> > Acked-by: Cong Wang <xiyou.wangcong@gmail.com> > Signed-off-by: Jason Baron <jbaron@akamai.com> Applied and queued up for -stable, thanks Jason.
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h index d93017a..e03827f 100644 --- a/include/net/flow_dissector.h +++ b/include/net/flow_dissector.h @@ -5,6 +5,7 @@ #include <linux/types.h> #include <linux/in6.h> #include <linux/siphash.h> +#include <linux/string.h> #include <uapi/linux/if_ether.h> struct sk_buff; @@ -349,4 +350,12 @@ struct bpf_flow_dissector { void *data_end; }; +static inline void +flow_dissector_init_keys(struct flow_dissector_key_control *key_control, + struct flow_dissector_key_basic *key_basic) +{ + memset(key_control, 0, sizeof(*key_control)); + memset(key_basic, 0, sizeof(*key_basic)); +} + #endif diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index f9c0d1e..b783254 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -305,6 +305,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp, struct cls_fl_filter *f; list_for_each_entry_rcu(mask, &head->masks, list) { + flow_dissector_init_keys(&skb_key.control, &skb_key.basic); fl_clear_masked_range(&skb_key, mask); skb_flow_dissect_meta(skb, &mask->dissector, &skb_key);