iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/sched
History
Eric Dumazet 55cd9f67f1 net_sched: ematch: reject invalid TCF_EM_SIMPLE 
It is possible for malicious userspace to set TCF_EM_SIMPLE bit
even for matches that should not have this bit set.

This can fool two places using tcf_em_is_simple()

1) tcf_em_tree_destroy() -> memory leak of em->data
   if ops->destroy() is NULL

2) tcf_em_tree_dump() wrongly report/leak 4 low-order bytes
   of a kernel pointer.

BUG: memory leak
unreferenced object 0xffff888121850a40 (size 32):
  comm "syz-executor927", pid 7193, jiffies 4294941655 (age 19.840s)
  hex dump (first 32 bytes):
    00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000f67036ea>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000f67036ea>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000f67036ea>] slab_alloc mm/slab.c:3320 [inline]
    [<00000000f67036ea>] __do_kmalloc mm/slab.c:3654 [inline]
    [<00000000f67036ea>] __kmalloc_track_caller+0x165/0x300 mm/slab.c:3671
    [<00000000fab0cc8e>] kmemdup+0x27/0x60 mm/util.c:127
    [<00000000d9992e0a>] kmemdup include/linux/string.h:453 [inline]
    [<00000000d9992e0a>] em_nbyte_change+0x5b/0x90 net/sched/em_nbyte.c:32
    [<000000007e04f711>] tcf_em_validate net/sched/ematch.c:241 [inline]
    [<000000007e04f711>] tcf_em_tree_validate net/sched/ematch.c:359 [inline]
    [<000000007e04f711>] tcf_em_tree_validate+0x332/0x46f net/sched/ematch.c:300
    [<000000007a769204>] basic_set_parms net/sched/cls_basic.c:157 [inline]
    [<000000007a769204>] basic_change+0x1d7/0x5f0 net/sched/cls_basic.c:219
    [<00000000e57a5997>] tc_new_tfilter+0x566/0xf70 net/sched/cls_api.c:2104
    [<0000000074b68559>] rtnetlink_rcv_msg+0x3b2/0x4b0 net/core/rtnetlink.c:5415
    [<00000000b7fe53fb>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
    [<00000000e83a40d0>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
    [<00000000d62ba933>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
    [<00000000d62ba933>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
    [<0000000088070f72>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
    [<00000000f70b15ea>] sock_sendmsg_nosec net/socket.c:639 [inline]
    [<00000000f70b15ea>] sock_sendmsg+0x54/0x70 net/socket.c:659
    [<00000000ef95a9be>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
    [<00000000b650f1ab>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
    [<0000000055bfa74a>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
    [<000000002abac183>] __do_sys_sendmsg net/socket.c:2426 [inline]
    [<000000002abac183>] __se_sys_sendmsg net/socket.c:2424 [inline]
    [<000000002abac183>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+03c4738ed29d5d366ddf@syzkaller.appspotmail.com
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-27 10:55:26 +01:00
..
act_api.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_bpf.c
net: sched: update action implementations to support flags
2019-10-30 18:07:51 -07:00
act_connmark.c
net: sched: update action implementations to support flags
2019-10-30 18:07:51 -07:00
act_csum.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_ct.c
treewide: Use sizeof_field() macro
2019-12-09 10:36:44 -08:00
act_ctinfo.c
net: sched: act_ctinfo: fix memory leak
2020-01-19 16:02:15 +01:00
act_gact.c
net: sched: update action implementations to support flags
2019-10-30 18:07:51 -07:00
act_ife.c
net/sched: act_ife: initalize ife->metalist earlier
2020-01-17 10:58:15 +01:00
act_ipt.c
net: sched: update action implementations to support flags
2019-10-30 18:07:51 -07:00
act_meta_mark.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
act_meta_skbprio.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
act_mirred.c
net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
2019-12-27 16:35:32 -08:00
act_mpls.c
net: Fixed updating of ethertype in skb_mpls_push()
2019-12-04 17:11:25 -08:00
act_nat.c
icmp: remove duplicate code
2019-11-05 14:03:11 -08:00
act_pedit.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2019-11-22 16:27:24 -08:00
act_police.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_sample.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_simple.c
net_sched: extend packet counter to 64bit
2019-11-05 18:20:55 -08:00
act_skbedit.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_skbmod.c
net: sched: update action implementations to support flags
2019-10-30 18:07:51 -07:00
act_tunnel_key.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
act_vlan.c
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-11-26 15:42:43 -08:00
cls_api.c
net_sched: use validated TCA_KIND attribute in tc_new_tfilter()
2020-01-22 21:11:50 +01:00
cls_basic.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_bpf.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_cgroup.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cls_flow.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cls_flower.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_fw.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_matchall.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_route.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_rsvp6.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cls_rsvp.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cls_rsvp.h
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_tcindex.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
cls_u32.c
net_sched: fix ops->bind_class() implementations
2020-01-27 10:51:43 +01:00
em_canid.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 11
2019-05-21 11:28:45 +02:00
em_cmp.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
em_ipset.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
em_ipt.c
net: sched: em_ipt: add support for addrtype matching
2019-06-29 11:15:12 -07:00
em_meta.c
net: annotate lockless accesses to sk->sk_max_ack_backlog
2019-11-06 16:14:48 -08:00
em_nbyte.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
em_text.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
em_u32.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ematch.c
net_sched: ematch: reject invalid TCF_EM_SIMPLE
2020-01-27 10:55:26 +01:00
Kconfig
net: sched: add Flow Queue PIE packet scheduler
2020-01-23 11:38:31 +01:00
Makefile
net: sched: add Flow Queue PIE packet scheduler
2020-01-23 11:38:31 +01:00
sch_api.c
net_sched: walk through all child classes in tc_bind_tclass()
2020-01-27 10:52:46 +01:00
sch_atm.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
sch_blackhole.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_cake.c
net: sched: use skb_list_walk_safe helper for gso segments
2020-01-14 11:48:41 -08:00
sch_cbq.c
sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
2019-09-30 11:07:46 -07:00
sch_cbs.c
net: sched: cbs: Avoid division by zero when calculating the port rate
2019-10-01 09:51:39 -07:00
sch_choke.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
sch_codel.c
net: sched: Fix a possible null-pointer dereference in dequeue_func()
2019-07-29 09:46:58 -07:00
sch_drr.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
sch_dsmark.c
sch_dsmark: fix potential NULL deref in dsmark_init()
2019-10-04 18:28:30 -07:00
sch_etf.c
sched: etf: Fix ordering of packets with same txtime
2019-10-15 20:32:04 -07:00
sch_ets.c
net: sch_ets: Make the ETS qdisc offloadable
2019-12-18 13:32:29 -08:00
sch_fifo.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_fq_codel.c
fq_codel: do not include <linux/jhash.h>
2019-10-22 15:31:42 -07:00
sch_fq_pie.c
net: sched: add Flow Queue PIE packet scheduler
2020-01-23 11:38:31 +01:00
sch_fq.c
pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
2020-01-08 12:40:47 -08:00
sch_generic.c
netdev: pass the stuck queue to the timeout handler
2019-12-12 21:38:57 -08:00
sch_gred.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_hfsc.c
netlink: make validation more configurable for future strictness
2019-04-27 17:07:21 -04:00
sch_hhf.c
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
sch_htb.c
net: sched: sch_htb: don't call qdisc_put() while holding tree lock
2019-09-27 12:13:55 +02:00
sch_ingress.c
net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*
2019-07-09 14:38:50 -07:00
sch_mq.c
net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
2019-12-03 11:53:55 -08:00
sch_mqprio.c
mqprio: Fix out-of-bounds access in mqprio_dump
2019-12-06 11:58:45 -08:00
sch_multiq.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-11-30 10:38:40 -08:00
sch_netem.c
net: netem: correct the parent's backlog when corrupted packet was dropped
2019-10-19 12:12:36 -07:00
sch_pie.c
net: sched: pie: export symbols to be reused by FQ-PIE
2020-01-23 11:38:31 +01:00
sch_plug.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_prio.c
net: sch_prio: When ungrafting, replace with FIFO
2020-01-08 12:45:53 -08:00
sch_qfq.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
sch_red.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_sfb.c
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
sch_sfq.c
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
sch_skbprio.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sch_taprio.c
taprio: don't reject same mqprio settings
2019-11-19 15:23:15 -08:00
sch_tbf.c
net: sched: Make TBF Qdisc offloadable
2020-01-25 10:56:31 +01:00
sch_teql.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00