• Davide Caratti's avatar
    net/sched: let actions use RCU to access 'goto_chain' · ee3bbfe8
    Davide Caratti authored
    use RCU when accessing the action chain, to avoid use after free in the
    traffic path when 'goto chain' is replaced on existing TC actions (see
    script below). Since the control action is read in the traffic path
    without holding the action spinlock, we need to explicitly ensure that
    a->goto_chain is not NULL before dereferencing (i.e it's not sufficient
    to rely on the value of TC_ACT_GOTO_CHAIN bits). Not doing so caused NULL
    dereferences in tcf_action_goto_chain_exec() when the following script:
    
     # tc chain add dev dd0 chain 42 ingress protocol ip flower \
     > ip_proto udp action pass index 4
     # tc filter add dev dd0 ingress protocol ip flower \
     > ip_proto udp action csum udp goto chain 42 index 66
     # tc chain del dev dd0 chain 42 ingress
     (start UDP traffic towards dd0)
     # tc action replace action csum udp pass index 66
    
    was run repeatedly for several hours.
    Suggested-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Suggested-by: default avatarVlad Buslov <vladbu@mellanox.com>
    Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ee3bbfe8
cls_api.c 81.7 KB