kernel_optimize_test/net/sched
Davide Caratti ee3bbfe806 net/sched: let actions use RCU to access 'goto_chain'
use RCU when accessing the action chain, to avoid use after free in the
traffic path when 'goto chain' is replaced on existing TC actions (see
script below). Since the control action is read in the traffic path
without holding the action spinlock, we need to explicitly ensure that
a->goto_chain is not NULL before dereferencing (i.e it's not sufficient
to rely on the value of TC_ACT_GOTO_CHAIN bits). Not doing so caused NULL
dereferences in tcf_action_goto_chain_exec() when the following script:

 # tc chain add dev dd0 chain 42 ingress protocol ip flower \
 > ip_proto udp action pass index 4
 # tc filter add dev dd0 ingress protocol ip flower \
 > ip_proto udp action csum udp goto chain 42 index 66
 # tc chain del dev dd0 chain 42 ingress
 (start UDP traffic towards dd0)
 # tc action replace action csum udp pass index 66

was run repeatedly for several hours.

Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Suggested-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-21 13:26:42 -07:00
..
act_api.c net/sched: let actions use RCU to access 'goto_chain' 2019-03-21 13:26:42 -07:00
act_bpf.c net/sched: act_bpf: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_connmark.c net/sched: act_connmark: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_csum.c net/sched: act_csum: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_gact.c net/sched: act_gact: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_ife.c net/sched: act_ife: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_ipt.c net/sched: prepare TC actions to properly validate the control action 2019-03-21 13:26:41 -07:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c net/sched: act_mirred: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_nat.c net/sched: act_nat: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_pedit.c net/sched: act_pedit: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_police.c net/sched: act_police: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_sample.c net/sched: act_sample: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_simple.c net/sched: act_simple: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_skbedit.c net/sched: act_skbedit: validate the control action inside init() 2019-03-21 13:26:41 -07:00
act_skbmod.c net/sched: act_skbmod: validate the control action inside init() 2019-03-21 13:26:42 -07:00
act_tunnel_key.c net/sched: act_tunnel_key: validate the control action inside init() 2019-03-21 13:26:42 -07:00
act_vlan.c net/sched: act_vlan: validate the control action inside init() 2019-03-21 13:26:42 -07:00
cls_api.c net/sched: let actions use RCU to access 'goto_chain' 2019-03-21 13:26:42 -07:00
cls_basic.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_bpf.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_cgroup.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flow.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flower.c net: sched: flower: insert new filter to idr after setting its mask 2019-03-06 10:52:16 -08:00
cls_fw.c Revert "net: sched: fw: don't set arg->stop in fw_walk() when empty" 2019-02-27 10:12:19 -08:00
cls_matchall.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_route.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_rsvp.c
cls_rsvp.h net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_rsvp6.c
cls_tcindex.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_u32.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c net_sched: return correct value for *notify* functions 2019-03-13 13:48:27 -07:00
sch_atm.c
sch_blackhole.c
sch_cake.c sch_cake: Interpret fwmark parameter as a bitmask 2019-03-15 11:57:14 -07:00
sch_cbq.c
sch_cbs.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_choke.c
sch_codel.c
sch_drr.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_dsmark.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_etf.c etf: Drop all expired packets 2018-11-16 20:39:34 -08:00
sch_fifo.c
sch_fq_codel.c
sch_fq.c net_sched: sch_fq: avoid calling ktime_get_ns() if not needed 2018-11-20 09:51:32 -08:00
sch_generic.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-04 13:26:15 -08:00
sch_gred.c net: sched: gred: support reporting stats from offloads 2018-11-19 18:53:46 -08:00
sch_hfsc.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_hhf.c
sch_htb.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_ingress.c
sch_mq.c net: sched: mq: offload a graft notification 2018-11-14 08:51:28 -08:00
sch_mqprio.c
sch_multiq.c
sch_netem.c net: netem: fix skb length BUG_ON in __skb_to_sgvec 2019-02-28 10:31:31 -08:00
sch_pie.c net: sched: pie: avoid slow division in drop probability decay 2019-02-28 10:35:41 -08:00
sch_plug.c
sch_prio.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_qfq.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_red.c net: sched: red: notify drivers about RED's limit parameter 2018-11-14 08:51:28 -08:00
sch_sfb.c
sch_sfq.c
sch_skbprio.c
sch_taprio.c
sch_tbf.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_teql.c