queue-4.19/cls_matchall-avoid-panic-when-receiving-a-packet-before-filter-set.patch

   1 From foo@baz Sun 09 Jun 2019 09:25:15 AM CEST
   2 From: Matteo Croce <mcroce@redhat.com>
   3 Date: Thu, 2 May 2019 10:51:05 +0200
   4 Subject: cls_matchall: avoid panic when receiving a packet before filter set
   5
   6 From: Matteo Croce <mcroce@redhat.com>
   7
   8 [ Upstream commit 25426043ec9e22b90c789407c28e40f32a9d1985 ]
   9
  10 When a matchall classifier is added, there is a small time interval in
  11 which tp->root is NULL. If we receive a packet in this small time slice
  12 a NULL pointer dereference will happen, leading to a kernel panic:
  13
  14     # tc qdisc replace dev eth0 ingress
  15     # tc filter add dev eth0 parent ffff: matchall action gact drop
  16     Unable to handle kernel NULL pointer dereference at virtual address 0000000000000034
  17     Mem abort info:
  18       ESR = 0x96000005
  19       Exception class = DABT (current EL), IL = 32 bits
  20       SET = 0, FnV = 0
  21       EA = 0, S1PTW = 0
  22     Data abort info:
  23       ISV = 0, ISS = 0x00000005
  24       CM = 0, WnR = 0
  25     user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000a623d530
  26     [0000000000000034] pgd=0000000000000000, pud=0000000000000000
  27     Internal error: Oops: 96000005 [#1] SMP
  28     Modules linked in: cls_matchall sch_ingress nls_iso8859_1 nls_cp437 vfat fat m25p80 spi_nor mtd xhci_plat_hcd xhci_hcd phy_generic sfp mdio_i2c usbcore i2c_mv64xxx marvell10g mvpp2 usb_common spi_orion mvmdio i2c_core sbsa_gwdt phylink ip_tables x_tables autofs4
  29     Process ksoftirqd/0 (pid: 9, stack limit = 0x0000000009de7d62)
  30     CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.1.0-rc6 #21
  31     Hardware name: Marvell 8040 MACCHIATOBin Double-shot (DT)
  32     pstate: 40000005 (nZcv daif -PAN -UAO)
  33     pc : mall_classify+0x28/0x78 [cls_matchall]
  34     lr : tcf_classify+0x78/0x138
  35     sp : ffffff80109db9d0
  36     x29: ffffff80109db9d0 x28: ffffffc426058800
  37     x27: 0000000000000000 x26: ffffffc425b0dd00
  38     x25: 0000000020000000 x24: 0000000000000000
  39     x23: ffffff80109dbac0 x22: 0000000000000001
  40     x21: ffffffc428ab5100 x20: ffffffc425b0dd00
  41     x19: ffffff80109dbac0 x18: 0000000000000000
  42     x17: 0000000000000000 x16: 0000000000000000
  43     x15: 0000000000000000 x14: 0000000000000000
  44     x13: ffffffbf108ad288 x12: dead000000000200
  45     x11: 00000000f0000000 x10: 0000000000000001
  46     x9 : ffffffbf1089a220 x8 : 0000000000000001
  47     x7 : ffffffbebffaa950 x6 : 0000000000000000
  48     x5 : 000000442d6ba000 x4 : 0000000000000000
  49     x3 : ffffff8008735ad8 x2 : ffffff80109dbac0
  50     x1 : ffffffc425b0dd00 x0 : ffffff8010592078
  51     Call trace:
  52      mall_classify+0x28/0x78 [cls_matchall]
  53      tcf_classify+0x78/0x138
  54      __netif_receive_skb_core+0x29c/0xa20
  55      __netif_receive_skb_one_core+0x34/0x60
  56      __netif_receive_skb+0x28/0x78
  57      netif_receive_skb_internal+0x2c/0xc0
  58      napi_gro_receive+0x1a0/0x1d8
  59      mvpp2_poll+0x928/0xb18 [mvpp2]
  60      net_rx_action+0x108/0x378
  61      __do_softirq+0x128/0x320
  62      run_ksoftirqd+0x44/0x60
  63      smpboot_thread_fn+0x168/0x1b0
  64      kthread+0x12c/0x130
  65      ret_from_fork+0x10/0x1c
  66     Code: aa0203f3 aa1e03e0 d503201f f9400684 (b9403480)
  67     ---[ end trace fc71e2ef7b8ab5a5 ]---
  68     Kernel panic - not syncing: Fatal exception in interrupt
  69     SMP: stopping secondary CPUs
  70     Kernel Offset: disabled
  71     CPU features: 0x002,00002000
  72     Memory Limit: none
  73     Rebooting in 1 seconds..
  74
  75 Fix this by adding a NULL check in mall_classify().
  76
  77 Fixes: ed76f5edccc9 ("net: sched: protect filter_chain list with filter_chain_lock mutex")
  78 Signed-off-by: Matteo Croce <mcroce@redhat.com>
  79 Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
  80 Signed-off-by: David S. Miller <davem@davemloft.net>
  81 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  82 ---
  83  net/sched/cls_matchall.c |    3 +++
  84  1 file changed, 3 insertions(+)
  85
  86 --- a/net/sched/cls_matchall.c
  87 +++ b/net/sched/cls_matchall.c
  88 @@ -30,6 +30,9 @@ static int mall_classify(struct sk_buff
  89  {
  90         struct cls_mall_head *head = rcu_dereference_bh(tp->root);
  91
  92 +       if (unlikely(!head))
  93 +               return -1;
  94 +
  95         if (tc_skip_sw(head->flags))
  96                 return -1;
  97