• Davide Caratti's avatar
    net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used · 38230a3e
    Davide Caratti authored
    the control action in the common member of struct tcf_tunnel_key must be a
    valid value, as it can contain the chain index when 'goto chain' is used.
    Ensure that the control action can be read as x->tcfa_action, when x is a
    pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to
    prevent the following command:
    
     # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
     > $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1
    
    from causing a NULL dereference when a matching packet is received:
    
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
     PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0
     Oops: 0000 [#1] SMP PTI
     CPU: 0 PID: 3491 Comm: mausezahn Tainted: G            E     4.18.0-rc2.auguri+ #421
     Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
     RIP: 0010:tcf_action_exec+0xb8/0x100
     Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
     RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
     RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
     RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
     RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
     R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
     R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
     FS:  00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
     Call Trace:
      <IRQ>
      fl_classify+0x1ad/0x1c0 [cls_flower]
      ? __update_load_avg_se.isra.47+0x1ca/0x1d0
      ? __update_load_avg_se.isra.47+0x1ca/0x1d0
      ? update_load_avg+0x665/0x690
      ? update_load_avg+0x665/0x690
      ? kmem_cache_alloc+0x38/0x1c0
      tcf_classify+0x89/0x140
      __netif_receive_skb_core+0x5ea/0xb70
      ? enqueue_entity+0xd0/0x270
      ? process_backlog+0x97/0x150
      process_backlog+0x97/0x150
      net_rx_action+0x14b/0x3e0
      __do_softirq+0xde/0x2b4
      do_softirq_own_stack+0x2a/0x40
      </IRQ>
      do_softirq.part.18+0x49/0x50
      __local_bh_enable_ip+0x49/0x50
      __dev_queue_xmit+0x4ab/0x8a0
      ? wait_woken+0x80/0x80
      ? packet_sendmsg+0x38f/0x810
      ? __dev_queue_xmit+0x8a0/0x8a0
      packet_sendmsg+0x38f/0x810
      sock_sendmsg+0x36/0x40
      __sys_sendto+0x10e/0x140
      ? do_vfs_ioctl+0xa4/0x630
      ? syscall_trace_enter+0x1df/0x2e0
      ? __audit_syscall_exit+0x22a/0x290
      __x64_sys_sendto+0x24/0x30
      do_syscall_64+0x5b/0x180
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
     RIP: 0033:0x7fd67e18dc93
     Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
     RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
     RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93
     RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003
     RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014
     R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
     R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003
     Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me
      mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca
     CR2: 0000000000000000
     ---[ end trace 1ab8b5b5d4639dfc ]---
     RIP: 0010:tcf_action_exec+0xb8/0x100
     Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
     RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
     RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
     RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
     RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
     R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
     R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
     FS:  00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
     Kernel panic - not syncing: Fatal exception in interrupt
     Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
     ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
    
    Fixes: d0f6dd8a ("net/sched: Introduce act_tunnel_key")
    Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    38230a3e
act_tunnel_key.c 9.19 KB