| Message ID | cover.1540070509.git.dcaratti@redhat.com |
|---|---|
| Headers | show |
| Series | net/sched: forbid 'goto_chain' on fallback actions | expand |
On 2018-10-20 5:33 p.m., Davide Caratti wrote: > the following command: > > # tc actions add action police rate 1mbit burst 1k conform-exceed \ > > pass / goto chain 42 > > generates a NULL pointer dereference when packets exceed the configured > rate. Similarly, the following command: > > # tc actions add action pass random determ goto chain 42 2 > > makes the kernel crash with NULL dereference when the first packet does > not match the 'pass' action. > > gact and police allow users to specify a fallback control action, that is > stored in the action private data. 'goto chain x' never worked for these > cases, since a->goto_chain handle was never initialized. There is only one > goto_chain handle per TC action, and it is designed to be non-NULL only if > tcf_action contains a 'goto chain' command. So, let's forbid 'goto chain' > on fallback actions. > > Patch 1/4 and 2/4 change the .init() functions of police and gact, to let > them return an error when users try to set 'goto chain x' in the fallback > action. Patch 3/4 and 4/4 add TDC selftest coverage to this new behavior. > For the series, Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> cheers, jamal
From: Davide Caratti <dcaratti@redhat.com> Date: Sat, 20 Oct 2018 23:33:06 +0200 > the following command: > > # tc actions add action police rate 1mbit burst 1k conform-exceed \ > > pass / goto chain 42 > > generates a NULL pointer dereference when packets exceed the configured > rate. Similarly, the following command: > > # tc actions add action pass random determ goto chain 42 2 > > makes the kernel crash with NULL dereference when the first packet does > not match the 'pass' action. > > gact and police allow users to specify a fallback control action, that is > stored in the action private data. 'goto chain x' never worked for these > cases, since a->goto_chain handle was never initialized. There is only one > goto_chain handle per TC action, and it is designed to be non-NULL only if > tcf_action contains a 'goto chain' command. So, let's forbid 'goto chain' > on fallback actions. > > Patch 1/4 and 2/4 change the .init() functions of police and gact, to let > them return an error when users try to set 'goto chain x' in the fallback > action. Patch 3/4 and 4/4 add TDC selftest coverage to this new behavior. Series applied.
the following command: # tc actions add action police rate 1mbit burst 1k conform-exceed \ > pass / goto chain 42 generates a NULL pointer dereference when packets exceed the configured rate. Similarly, the following command: # tc actions add action pass random determ goto chain 42 2 makes the kernel crash with NULL dereference when the first packet does not match the 'pass' action. gact and police allow users to specify a fallback control action, that is stored in the action private data. 'goto chain x' never worked for these cases, since a->goto_chain handle was never initialized. There is only one goto_chain handle per TC action, and it is designed to be non-NULL only if tcf_action contains a 'goto chain' command. So, let's forbid 'goto chain' on fallback actions. Patch 1/4 and 2/4 change the .init() functions of police and gact, to let them return an error when users try to set 'goto chain x' in the fallback action. Patch 3/4 and 4/4 add TDC selftest coverage to this new behavior. Davide Caratti (4): net/sched: act_gact: disallow 'goto chain' on fallback control action net/sched: act_police: disallow 'goto chain' on fallback control action tc-tests: test denial of 'goto chain' on 'random' traffic in gact.json tc-tests: test denial of 'goto chain' for exceed traffic in police.json net/sched/act_gact.c | 5 ++++ net/sched/act_police.c | 12 ++++++++-- .../tc-testing/tc-tests/actions/gact.json | 24 +++++++++++++++++++ .../tc-testing/tc-tests/actions/police.json | 24 +++++++++++++++++++ 4 files changed, 63 insertions(+), 2 deletions(-)