kernel_optimize_test/net/tipc
Neil Horman d0021b252e tipc: Fix oops on send prior to entering networked mode (v3)
Fix TIPC to disallow sending to remote addresses prior to entering NET_MODE

user programs can oops the kernel by sending datagrams via AF_TIPC prior to
entering networked mode.  The following backtrace has been observed:

ID: 13459  TASK: ffff810014640040  CPU: 0   COMMAND: "tipc-client"
[exception RIP: tipc_node_select_next_hop+90]
RIP: ffffffff8869d3c3  RSP: ffff81002d9a5ab8  RFLAGS: 00010202
RAX: 0000000000000001  RBX: 0000000000000001  RCX: 0000000000000001
RDX: 0000000000000000  RSI: 0000000000000001  RDI: 0000000001001001
RBP: 0000000001001001   R8: 0074736575716552   R9: 0000000000000000
R10: ffff81003fbd0680  R11: 00000000000000c8  R12: 0000000000000008
R13: 0000000000000001  R14: 0000000000000001  R15: ffff810015c6ca00
ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
RIP: 0000003cbd8d49a3  RSP: 00007fffc84e0be8  RFLAGS: 00010206
RAX: 000000000000002c  RBX: ffffffff8005d116  RCX: 0000000000000000
RDX: 0000000000000008  RSI: 00007fffc84e0c00  RDI: 0000000000000003
RBP: 0000000000000000   R8: 00007fffc84e0c10   R9: 0000000000000010
R10: 0000000000000000  R11: 0000000000000246  R12: 0000000000000000
R13: 00007fffc84e0d10  R14: 0000000000000000  R15: 00007fffc84e0c30
ORIG_RAX: 000000000000002c  CS: 0033  SS: 002b

What happens is that, when the tipc module in inserted it enters a standalone
node mode in which communication to its own address is allowed <0.0.0> but not
to other addresses, since the appropriate data structures have not been
allocated yet (specifically the tipc_net pointer).  There is nothing stopping a
client from trying to send such a message however, and if that happens, we
attempt to dereference tipc_net.zones while the pointer is still NULL, and
explode.  The fix is pretty straightforward.  Since these oopses all arise from
the dereference of global pointers prior to their assignment to allocated
values, and since these allocations are small (about 2k total), lets convert
these pointers to static arrays of the appropriate size.  All the accesses to
these bits consider 0/NULL to be a non match when searching, so all the lookups
still work properly, and there is no longer a chance of a bad dererence
anywhere.  As a bonus, this lets us eliminate the setup/teardown routines for
those pointers, and elimnates the need to preform any locking around them to
prevent access while their being allocated/freed.

I've updated the tipc_net structure to behave this way to fix the exact reported
problem, and also fixed up the tipc_bearers and media_list arrays to fix an
obvious simmilar problem that arises from issuing tipc-config commands to
manipulate bearers/links prior to entering networked mode

I've tested this for a few hours by running the sanity tests and stress test
with the tipcutils suite, and nothing has fallen over.  There have been a few
lockdep warnings, but those were there before, and can be addressed later, as
they didn't actually result in any deadlock.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Allan Stephens <allan.stephens@windriver.com>
CC: David S. Miller <davem@davemloft.net>
CC: tipc-discussion@lists.sourceforge.net

 bearer.c |   37 ++++++-------------------------------
 bearer.h |    2 +-
 net.c    |   25 ++++---------------------
 3 files changed, 11 insertions(+), 53 deletions(-)
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-04 00:53:52 -08:00
..
addr.c [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
addr.h [TIPC]: Kill unused static inline (x5) 2008-02-07 18:17:13 -08:00
bcast.c tipc: fix non-const printf format arguments 2009-03-18 19:11:29 -07:00
bcast.h tipc: fix non-const printf format arguments 2009-03-18 19:11:29 -07:00
bearer.c tipc: Fix oops on send prior to entering networked mode (v3) 2010-03-04 00:53:52 -08:00
bearer.h tipc: Fix oops on send prior to entering networked mode (v3) 2010-03-04 00:53:52 -08:00
cluster.c net: Move && and || to end of previous line 2009-11-29 16:55:45 -08:00
cluster.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
config.c tipc: Fix initialization sequence problems when entering network mode 2008-05-21 14:55:04 -07:00
config.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
core.c tipc: use kconfig to limit numeric ranges 2010-01-03 21:31:04 -08:00
core.h tipc: Fix initialization sequence problems when entering network mode 2008-05-21 14:55:04 -07:00
dbg.c tipc: fix non-const printf format arguments 2009-03-18 19:11:29 -07:00
dbg.h tipc: Elimination of print buffer chaining 2008-05-05 01:22:30 -07:00
discover.c tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
discover.h tipc: Minor optimizations to received message processing 2008-06-04 17:32:35 -07:00
eth_media.c net: remove needless (now buggy) & from dev->dev_addr 2009-05-17 11:59:47 -07:00
handler.c mm: Remove slab destructors from kmem_cache_create(). 2007-07-20 10:11:58 +09:00
Kconfig tipc: Clean up configuration file 2010-01-19 14:23:57 -08:00
link.c net: Move && and || to end of previous line 2009-11-29 16:55:45 -08:00
link.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
Makefile
msg.c tipc: Fix bugs in message error code display when debugging 2008-06-04 17:29:09 -07:00
msg.h tipc: Message rejection rework preparatory changes 2008-06-04 17:54:48 -07:00
name_distr.c tipc: Optimize message initialization routine 2008-06-04 17:37:34 -07:00
name_distr.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
name_table.c tipc: trivial endian annotation in debug statement 2008-11-07 23:37:50 -08:00
name_table.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
net.c tipc: Fix oops on send prior to entering networked mode (v3) 2010-03-04 00:53:52 -08:00
net.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
netlink.c genetlink: make netns aware 2009-07-12 14:03:27 -07:00
node_subscr.c tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
node_subscr.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
node.c tipc: fix non-const printf format arguments 2009-03-18 19:11:29 -07:00
node.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
port.c tipc: Eliminate improper use of TIPC_OK error code 2008-07-14 22:44:01 -07:00
port.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
ref.c tipc: Eliminate improper use of TIPC_OK error code 2008-07-14 22:44:01 -07:00
ref.h [TIPC]: Remove inlining of reference table locking routines 2008-04-16 18:21:16 -07:00
socket.c net: Move && and || to end of previous line 2009-11-29 16:55:45 -08:00
subscr.c net: Move && and || to end of previous line 2009-11-29 16:55:45 -08:00
subscr.h tipc: Cosmetic cleanup of topology service code 2008-05-19 13:30:13 -07:00
user_reg.c tipc: Eliminate improper use of TIPC_OK error code 2008-07-14 22:44:01 -07:00
user_reg.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
zone.c tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00
zone.h tipc: Don't use structure names which easily globally conflict. 2008-09-02 23:38:32 -07:00