android_kernel_oneplus_msm8998/net/sched
Davide Caratti d3d6c67880 net/sched: act_pedit: fix WARN() in the traffic path
[ Upstream commit f67169fef8dbcc1ac6a6a109ecaad0d3b259002c ]

when configuring act_pedit rules, the number of keys is validated only on
addition of a new entry. This is not sufficient to avoid hitting a WARN()
in the traffic path: for example, it is possible to replace a valid entry
with a new one having 0 extended keys, thus causing splats in dmesg like:

 pedit BUG: index 42
 WARNING: CPU: 2 PID: 4054 at net/sched/act_pedit.c:410 tcf_pedit_act+0xc84/0x1200 [act_pedit]
 [...]
 RIP: 0010:tcf_pedit_act+0xc84/0x1200 [act_pedit]
 Code: 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ac 00 00 00 48 8b 44 24 10 48 c7 c7 a0 c4 e4 c0 8b 70 18 e8 1c 30 95 ea <0f> 0b e9 a0 fa ff ff e8 00 03 f5 ea e9 14 f4 ff ff 48 89 58 40 e9
 RSP: 0018:ffff888077c9f320 EFLAGS: 00010286
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffac2983a2
 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff888053927bec
 RBP: dffffc0000000000 R08: ffffed100a726209 R09: ffffed100a726209
 R10: 0000000000000001 R11: ffffed100a726208 R12: ffff88804beea780
 R13: ffff888079a77400 R14: ffff88804beea780 R15: ffff888027ab2000
 FS:  00007fdeec9bd740(0000) GS:ffff888053900000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007ffdb3dfd000 CR3: 000000004adb4006 CR4: 00000000001606e0
 Call Trace:
  tcf_action_exec+0x105/0x3f0
  tcf_classify+0xf2/0x410
  __dev_queue_xmit+0xcbf/0x2ae0
  ip_finish_output2+0x711/0x1fb0
  ip_output+0x1bf/0x4b0
  ip_send_skb+0x37/0xa0
  raw_sendmsg+0x180c/0x2430
  sock_sendmsg+0xdb/0x110
  __sys_sendto+0x257/0x2b0
  __x64_sys_sendto+0xdd/0x1b0
  do_syscall_64+0xa5/0x4e0
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
 RIP: 0033:0x7fdeeb72e993
 Code: 48 8b 0d e0 74 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 0d d6 2c 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 4b cc 00 00 48 89 04 24
 RSP: 002b:00007ffdb3de8a18 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 RAX: ffffffffffffffda RBX: 000055c81972b700 RCX: 00007fdeeb72e993
 RDX: 0000000000000040 RSI: 000055c81972b700 RDI: 0000000000000003
 RBP: 00007ffdb3dea130 R08: 000055c819728510 R09: 0000000000000010
 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
 R13: 000055c81972b6c0 R14: 000055c81972969c R15: 0000000000000080

Fix this moving the check on 'nkeys' earlier in tcf_pedit_init(), so that
attempts to install rules having 0 keys are always rejected with -EINVAL.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-28 18:25:26 +01:00
..
act_api.c net: avoid potential infinite loop in tc_ctl_action() 2019-10-29 09:13:22 +01:00
act_bpf.c net/sched: fix NULL dereference in the error path of tcf_bpf_init() 2018-04-13 19:50:25 +02:00
act_connmark.c act_connmark: avoid crashing on malformed nlattrs with null parms 2017-03-22 12:04:16 +01:00
act_csum.c sched: act_csum: don't mangle TCP and UDP GSO packets 2018-03-22 09:23:22 +01:00
act_gact.c net_sched: act_gact: remove spinlock in fast path 2015-07-08 13:50:42 -07:00
act_ipt.c net: sched: fix NULL pointer dereference when action calls some targets 2017-08-30 10:19:21 +02:00
act_mirred.c net_sched: close another race condition in tcf_mirred_release() 2017-05-02 21:19:49 -07:00
act_nat.c bpf: try harder on clones when writing into skb 2016-07-11 09:31:12 -07:00
act_pedit.c net/sched: act_pedit: fix WARN() in the traffic path 2019-11-28 18:25:26 +01:00
act_police.c sched: fix act file names in header comment 2014-11-06 15:04:41 -05:00
act_simple.c net: sched: add percpu stats to actions 2015-07-08 13:50:41 -07:00
act_skbedit.c net: sched: add percpu stats to actions 2015-07-08 13:50:41 -07:00
act_vlan.c net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions 2016-11-15 07:46:37 +01:00
cls_api.c net, sched: fix soft lockup in tc_classify 2017-01-15 13:41:34 +01:00
cls_basic.c net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_bpf.c net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_cgroup.c net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_flow.c net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_flower.c net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_fw.c net: revert "net_sched: move tp->root allocation into fw_init()" 2015-09-24 14:33:30 -07:00
cls_route.c net_sched: destroy proto tp when all filters are gone 2015-03-09 15:35:55 -04:00
cls_rsvp.c
cls_rsvp.h net, sched: respect rcu grace period on cls destruction 2016-12-10 19:07:23 +01:00
cls_rsvp6.c
cls_tcindex.c net_sched: fix NULL pointer dereference when delete tcindex filter 2018-08-22 07:48:35 +02:00
cls_u32.c net: sched: Fix memory exposure from short TCA_U32_SEL 2019-10-29 09:13:32 +01:00
em_canid.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_cmp.c
em_ipset.c netfilter: x_tables: Pass struct net in xt_action_param 2015-09-18 21:58:14 +02:00
em_meta.c net_sched: em_meta: use skb_to_full_sk() helper 2015-11-08 20:56:39 -05:00
em_nbyte.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_text.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
em_u32.c
ematch.c ematch: Fix auto-loading of ematch modules. 2015-02-20 15:30:56 -05:00
Kconfig net: add CONFIG_NET_INGRESS to enable ingress filtering 2015-05-14 01:10:05 -04:00
Makefile tc: introduce Flower classifier 2015-05-13 15:19:48 -04:00
sch_api.c net_sched: refetch skb protocol for each filter 2019-02-06 19:43:03 +01:00
sch_atm.c net: sched: consolidate tc_classify{,_compat} 2015-08-27 14:18:48 -07:00
sch_blackhole.c net_sched: blackhole: tell upper qdisc about dropped packets 2018-07-22 14:25:53 +02:00
sch_cbq.c sch_cbq: validate TCA_CBQ_WRROPT to avoid crash 2019-10-07 21:01:06 +02:00
sch_choke.c net_sched: red: Avoid illegal values 2018-02-25 11:03:40 +01:00
sch_codel.c net: sched: Fix a possible null-pointer dereference in dequeue_func() 2019-08-11 12:20:45 +02:00
sch_drr.c net_sched: update hierarchical backlog too 2016-05-18 17:06:39 -07:00
sch_dsmark.c sch_dsmark: fix potential NULL deref in dsmark_init() 2019-10-07 21:01:05 +02:00
sch_fifo.c net_sched: fix pfifo_head_drop behavior vs backlog 2016-07-11 09:31:11 -07:00
sch_fq.c net_sched: fq: take care of throttled flows before reuse 2018-05-26 08:48:47 +02:00
sch_fq_codel.c net/flow_dissector: switch to siphash 2019-11-10 11:21:14 +01:00
sch_generic.c net_sched: let qdisc_put() accept NULL pointer 2019-09-21 07:12:54 +02:00
sch_gred.c net: sched: gred: pass the right attribute to gred_change_table_def() 2018-11-10 07:41:41 -08:00
sch_hfsc.c net_sched: update hierarchical backlog too 2016-05-18 17:06:39 -07:00
sch_hhf.c net/flow_dissector: switch to siphash 2019-11-10 11:21:14 +01:00
sch_htb.c sch_htb: fix crash on init failure 2018-09-15 09:40:41 +02:00
sch_ingress.c net: sched: further simplify handle_ing 2015-05-11 11:10:35 -04:00
sch_mq.c net_sched: fix error recovery at qdisc creation 2017-07-21 07:44:54 +02:00
sch_mqprio.c net_sched: fix error recovery at qdisc creation 2017-07-21 07:44:54 +02:00
sch_multiq.c sch_multiq: fix double free on init failure 2018-09-15 09:40:41 +02:00
sch_netem.c sch_netem: fix rcu splat in netem_enqueue() 2019-11-06 12:09:24 +01:00
sch_pie.c net_sched: update hierarchical backlog too 2016-05-18 17:06:39 -07:00
sch_plug.c net: sched: drop all special handling of tx_queue_len == 0 2015-08-18 11:55:08 -07:00
sch_prio.c net_sched: update hierarchical backlog too 2016-05-18 17:06:39 -07:00
sch_qfq.c net_sched: update hierarchical backlog too 2016-05-18 17:06:39 -07:00
sch_red.c sch_red: update backlog as well 2018-11-10 07:41:37 -08:00
sch_sfb.c net/flow_dissector: switch to siphash 2019-11-10 11:21:14 +01:00
sch_sfq.c net/flow_dissector: switch to siphash 2019-11-10 11:21:14 +01:00
sch_tbf.c net: create skb_gso_validate_mac_len() 2019-06-11 12:24:10 +02:00
sch_teql.c net: sched: fix skb->protocol use in case of accelerated vlan path 2015-01-13 17:51:08 -05:00