Re: [PATCH net-next 1/1] net sched actions: return explicit error when tunnel_key mode is not specified

[David Miller]

From: Roman Mashak 
Date: Mon, 12 Mar 2018 16:20:58 -0400

> If set/unset mode of the tunnel_key action is not provided, ->init() still
> returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
> this results in crash:
> 
> % tc actions add action tunnel_key src_ip 1.1.1.1 dst_ip 2.2.2.1 id 7 index 1
 ...
> Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
> Signed-off-by: Roman Mashak 

Applied to net and queued up for -stable.

Re: [PATCH net-next 1/1] net sched actions: return explicit error when tunnel_key mode is not specified

[Cong Wang]

On Mon, Mar 12, 2018 at 1:20 PM, Roman Mashak  wrote:
> If set/unset mode of the tunnel_key action is not provided, ->init() still
> returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
> this results in crash:

...

> Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
> Signed-off-by: Roman Mashak 

Acked-by: Cong Wang 

This should go to -net rather than -net-next.

Thanks.

[PATCH net-next 1/1] net sched actions: return explicit error when tunnel_key mode is not specified

[Roman Mashak]

If set/unset mode of the tunnel_key action is not provided, ->init() still
returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
this results in crash:

% tc actions add action tunnel_key src_ip 1.1.1.1 dst_ip 2.2.2.1 id 7 index 1

[   35.805515] general protection fault:  [#1] SMP PTI
[   35.806161] Modules linked in: act_tunnel_key kvm_intel kvm irqbypass
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64
crypto_simd glue_helper cryptd serio_raw
[   35.808233] CPU: 1 PID: 428 Comm: tc Not tainted 4.16.0-rc4+ #286
[   35.808929] RIP: 0010:tcf_action_init+0x90/0x190
[   35.809457] RSP: 0018:b8edc068b9a0 EFLAGS: 00010206
[   35.810053] RAX: 1320c00a0003 RBX: 0001 RCX: 
[   35.810866] RDX: 0070 RSI: 7965 RDI: b8edc068b910
[   35.811660] RBP: b8edc068b9d0 R08:  R09: b8edc068b808
[   35.812463] R10: c02bf040 R11: 0040 R12: b8edc068bb38
[   35.813235] R13:  R14:  R15: b8edc068b910
[   35.814006] FS:  7f3d0d8556c0() GS:91d1dbc4()
knlGS:
[   35.814881] CS:  0010 DS:  ES:  CR0: 80050033
[   35.815540] CR2: 0043f720 CR3: 19248001 CR4: 001606a0
[   35.816457] Call Trace:
[   35.817158]  tc_ctl_action+0x11a/0x220
[   35.817795]  rtnetlink_rcv_msg+0x23d/0x2e0
[   35.818457]  ? __slab_alloc+0x1c/0x30
[   35.819079]  ? __kmalloc_node_track_caller+0xb1/0x2b0
[   35.819544]  ? rtnl_calcit.isra.30+0xe0/0xe0
[   35.820231]  netlink_rcv_skb+0xce/0x100
[   35.820744]  netlink_unicast+0x164/0x220
[   35.821500]  netlink_sendmsg+0x293/0x370
[   35.822040]  sock_sendmsg+0x30/0x40
[   35.822508]  ___sys_sendmsg+0x2c5/0x2e0
[   35.823149]  ? pagecache_get_page+0x27/0x220
[   35.823714]  ? filemap_fault+0xa2/0x640
[   35.824423]  ? page_add_file_rmap+0x108/0x200
[   35.825065]  ? alloc_set_pte+0x2aa/0x530
[   35.825585]  ? finish_fault+0x4e/0x70
[   35.826140]  ? __handle_mm_fault+0xbc1/0x10d0
[   35.826723]  ? __sys_sendmsg+0x41/0x70
[   35.827230]  __sys_sendmsg+0x41/0x70
[   35.827710]  do_syscall_64+0x68/0x120
[   35.828195]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[   35.828859] RIP: 0033:0x7f3d0ca4da67
[   35.829331] RSP: 002b:7ffc9f284338 EFLAGS: 0246 ORIG_RAX:
002e
[   35.830304] RAX: ffda RBX: 7ffc9f284460 RCX: 7f3d0ca4da67
[   35.831247] RDX:  RSI: 7ffc9f2843b0 RDI: 0003
[   35.832167] RBP: 5aa6a7a9 R08: 0001 R09: 
[   35.833075] R10: 05f1 R11: 0246 R12: 
[   35.833997] R13: 7ffc9f2884c0 R14: 0001 R15: 00674640
[   35.834923] Code: 24 30 bb 01 00 00 00 45 31 f6 eb 5e 8b 50 08 83 c2 07 83 e2
fc 83 c2 70 49 8b 07 48 8b 40 70 48 85 c0 74 10 48 89 14 24 4c 89 ff  d0 48
8b 14 24 48 01 c2 49 01 d6 45 85 ed 74 05 41 83 47 2c 
[   35.837442] RIP: tcf_action_init+0x90/0x190 RSP: b8edc068b9a0
[   35.838291] ---[ end trace a095c06ee4b97a26 ]---

Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Roman Mashak 
---
 net/sched/act_tunnel_key.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 9169b7e78ada..0c0fbbfbc63b 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *net, struct nlattr 
*nla,
metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
break;
default:
+   ret = -EINVAL;
goto err_out;
}
 
-- 
2.7.4