Nikolay Aleksandrov 7edd04ddb3 sch_htb: fix crash on init failure ... commit 88c2ace69dbef696edba77712882af03879abc9c upstream. The commit below added a call to the ->destroy() callback for all qdiscs which failed in their ->init(), but some were not prepared for such change and can't handle partially initialized qdisc. HTB is one of them and if any error occurs before the qdisc watchdog timer and qdisc work are initialized then we can hit either a null ptr deref (timer->base) when canceling in ->destroy or lockdep error info about trying to register a non-static key and a stack dump. So to fix these two move the watchdog timer and workqueue init before anything that can err out. To reproduce userspace needs to send broken htb qdisc create request, tested with a modified tc (q_htb.c). Trace log: [ 2710.897602] BUG: unable to handle kernel NULL pointer dereference at (null) [ 2710.897977] IP: hrtimer_active+0x17/0x8a [ 2710.898174] PGD 58fab067 [ 2710.898175] P4D 58fab067 [ 2710.898353] PUD 586c0067 [ 2710.898531] PMD 0 [ 2710.898710] [ 2710.899045] Oops: 0000 [#1] SMP [ 2710.899232] Modules linked in: [ 2710.899419] CPU: 1 PID: 950 Comm: tc Not tainted 4.13.0-rc6+ #54 [ 2710.899646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 2710.900035] task: ffff880059ed2700 task.stack: ffff88005ad4c000 [ 2710.900262] RIP: 0010:hrtimer_active+0x17/0x8a [ 2710.900467] RSP: 0018:ffff88005ad4f960 EFLAGS: 00010246 [ 2710.900684] RAX: 0000000000000000 RBX: ffff88003701e298 RCX: 0000000000000000 [ 2710.900933] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003701e298 [ 2710.901177] RBP: ffff88005ad4f980 R08: 0000000000000001 R09: 0000000000000001 [ 2710.901419] R10: ffff88005ad4f800 R11: 0000000000000400 R12: 0000000000000000 [ 2710.901663] R13: ffff88003701e298 R14: ffffffff822a4540 R15: ffff88005ad4fac0 [ 2710.901907] FS: 00007f2f5e90f740(0000) GS:ffff88005d880000(0000) knlGS:0000000000000000 [ 2710.902277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2710.902500] CR2: 0000000000000000 CR3: 0000000058ca3000 CR4: 00000000000406e0 [ 2710.902744] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2710.902977] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2710.903180] Call Trace: [ 2710.903332] hrtimer_try_to_cancel+0x1a/0x93 [ 2710.903504] hrtimer_cancel+0x15/0x20 [ 2710.903667] qdisc_watchdog_cancel+0x12/0x14 [ 2710.903866] htb_destroy+0x2e/0xf7 [ 2710.904097] qdisc_create+0x377/0x3fd [ 2710.904330] tc_modify_qdisc+0x4d2/0x4fd [ 2710.904511] rtnetlink_rcv_msg+0x188/0x197 [ 2710.904682] ? rcu_read_unlock+0x3e/0x5f [ 2710.904849] ? rtnl_newlink+0x729/0x729 [ 2710.905017] netlink_rcv_skb+0x6c/0xce [ 2710.905183] rtnetlink_rcv+0x23/0x2a [ 2710.905345] netlink_unicast+0x103/0x181 [ 2710.905511] netlink_sendmsg+0x326/0x337 [ 2710.905679] sock_sendmsg_nosec+0x14/0x3f [ 2710.905847] sock_sendmsg+0x29/0x2e [ 2710.906010] ___sys_sendmsg+0x209/0x28b [ 2710.906176] ? do_raw_spin_unlock+0xcd/0xf8 [ 2710.906346] ? _raw_spin_unlock+0x27/0x31 [ 2710.906514] ? __handle_mm_fault+0x651/0xdb1 [ 2710.906685] ? check_chain_key+0xb0/0xfd [ 2710.906855] __sys_sendmsg+0x45/0x63 [ 2710.907018] ? __sys_sendmsg+0x45/0x63 [ 2710.907185] SyS_sendmsg+0x19/0x1b [ 2710.907344] entry_SYSCALL_64_fastpath+0x23/0xc2 Note that probably this bug goes further back because the default qdisc handling always calls ->destroy on init failure too. Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Fixes: 0fbbeb1ba4 ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> [AmitP: Rebased for linux-4.4.y] Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-15 09:40:41 +02:00
..
6lowpan	6lowpan: put mcast compression in an own function	2015-10-21 00:49:25 +02:00
9p	net/9p: fix error path of p9_virtio_probe	2018-09-15 09:40:39 +02:00
802
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-13 19:50:25 +02:00
appletalk
atm	net: atm: Fix potential Spectre v1	2018-05-16 10:06:51 +02:00
ax25	ax25: Fix segfault after sock connection timeout	2017-02-04 09:45:09 +01:00
batman-adv	batman-adv: fix packet loss for broadcasted DHCP packets to a server	2018-05-30 07:49:06 +02:00
bluetooth	Bluetooth: avoid killing an already killed socket	2018-08-22 07:48:37 +02:00
bridge	bridge: Propagate vlan add failure to user	2018-08-24 13:27:01 +02:00
caif	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb	2018-09-05 09:18:34 +02:00
can	can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once	2018-01-31 12:06:08 +01:00
ceph	libceph: validate con->state at the top of try_write()	2018-05-02 07:53:42 -07:00
core	net: propagate dev_get_valid_name return code	2018-08-24 13:26:55 +02:00
dcb	net/dcb: make dcbnl.c explicitly non-modular	2015-10-09 07:52:27 -07:00
dccp	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-22 07:48:35 +02:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:03:38 +01:00
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:25:54 +02:00
dsa	net: dsa: Do not suspend/resume closed slave_dev	2018-08-06 16:24:41 +02:00
ethernet	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
hsr	net/hsr: fix a warning message	2015-11-23 14:56:15 -05:00
ieee802154	net: 6lowpan: fix reserved space for single frames	2018-09-09 20:04:32 +02:00
ipv4	tcp: do not restart timewait timer on rst reception	2018-09-15 09:40:37 +02:00
ipv6	vti6: remove !skb->ignore_df check from vti6_xmit()	2018-09-15 09:40:37 +02:00
ipx	ipx: call ipxitf_put() in ioctl error path	2017-05-25 14:30:13 +02:00
irda	irda: Only insert new objects into the global database via setsockopt	2018-09-15 09:40:40 +02:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:12:33 +02:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:54:25 +02:00
l2tp	l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache	2018-08-22 07:48:35 +02:00
l3mdev	net: Add netif_is_l3_slave	2015-10-07 04:27:43 -07:00
lapb
llc	llc: use refcount_inc_not_zero() for llc_sap_find()	2018-08-22 07:48:35 +02:00
mac80211	mac80211: add stations tied to AP_VLANs during hw reconfig	2018-09-05 09:18:33 +02:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 20:04:32 +02:00
mpls	mpls, nospec: Sanitize array index in mpls_label_ok()	2018-03-11 16:19:47 +01:00
netfilter	ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()	2018-09-15 09:40:38 +02:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-05-30 07:49:17 +02:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:19:28 +02:00
netrom	netfilter: Remove spurios included of netfilter.h	2015-06-18 21:14:32 +02:00
nfc	net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.	2018-07-22 14:25:54 +02:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-26 08:48:47 +02:00
packet	packet: refine ring v3 block size test to hold one frame	2018-08-24 13:27:01 +02:00
phonet	phonet: properly unshare skbs in phonet_rcv()	2016-01-31 11:29:00 -08:00
rds	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:06:51 +02:00
rose	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-06-24 02:58:51 -07:00
rxrpc	rxrpc: check return value of skb_to_sgvec always	2018-04-13 19:50:23 +02:00
sched	sch_htb: fix crash on init failure	2018-09-15 09:40:41 +02:00
sctp	sctp: delay the authentication for the duplicated cookie-echo chunk	2018-05-26 08:48:49 +02:00
sunrpc	rpc_pipefs: fix double-dput()	2018-04-24 09:32:11 +02:00
switchdev	switchdev: pass pointer to fib_info instead of copy	2016-06-24 10:18:16 -07:00
tipc	tipc: add policy for TIPC_NLA_NET_ADDR	2018-04-29 07:50:06 +02:00
unix	net/unix: don't show information about sockets from other namespaces	2017-11-18 11:11:06 +01:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-22 07:48:35 +02:00
wimax	net:wimax: Fix doucble word "the the" in networking.xml	2015-08-09 22:43:52 -07:00
wireless	nl80211: Add a missing break in parse_station_flags	2018-09-05 09:18:34 +02:00
x25	net: x25: fix one potential use-after-free issue	2018-04-13 19:50:07 +02:00
xfrm	xfrm: free skb if nlsk pointer is NULL	2018-09-05 09:18:33 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-05-26 08:48:47 +02:00
Kconfig	Make DST_CACHE a silent config option	2018-02-25 11:03:37 +01:00
Makefile	net: Introduce L3 Master device abstraction	2015-09-29 20:40:32 -07:00
socket.c	net: socket: fix potential spectre v1 gadget in socketcall	2018-08-06 16:24:42 +02:00
sysctl_net.c	net: Use ns_capable_noaudit() when determining net sysctl permissions	2016-09-15 08:27:50 +02:00