Eric Dumazet
3cb7cf1540
net/sched: accept TCA_STAB only for root qdisc
Most qdiscs maintain their backlog using qdisc_pkt_len(skb)
on the assumption it is invariant between the enqueue()
and dequeue() handlers.
Unfortunately syzbot can crash a host rather easily using
a TBF + SFQ combination, with an STAB on SFQ [1]
We can't support TCA_STAB on arbitrary level, this would
require to maintain per-qdisc storage.
[1]
[ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 88.798611] #PF: supervisor read access in kernel mode
[ 88.799014] #PF: error_code(0x0000) - not-present page
[ 88.799506] PGD 0 P4D 0
[ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI
[ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117
[ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq
[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00
All code
========
0: 0f b7 50 12 movzwl 0x12(%rax),%edx
4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax
b: 00
c: 48 89 d6 mov %rdx,%rsi
f: 48 29 d0 sub %rdx,%rax
12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx
19: 48 c1 e0 03 shl $0x3,%rax
1d: 48 01 c2 add %rax,%rdx
20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx)
25: 7e c0 jle 0xffffffffffffffe7
27: 48 8b 3a mov (%rdx),%rdi
2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction
2d: 4c 89 02 mov %r8,(%rdx)
30: 49 89 50 08 mov %rdx,0x8(%r8)
34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi)
3b: 00
3c: 48 rex.W
3d: c7 .byte 0xc7
3e: 07 (bad)
...
Code starting with the faulting instruction
===========================================
0: 4c 8b 07 mov (%rdi),%r8
3: 4c 89 02 mov %r8,(%rdx)
6: 49 89 50 08 mov %rdx,0x8(%r8)
a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi)
11: 00
12: 48 rex.W
13: c7 .byte 0xc7
14: 07 (bad)
...
[ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206
[ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800
[ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000
[ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f
[ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140
[ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac
[ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000
[ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0
[ 88.808165] Call Trace:
[ 88.808459] <TASK>
[ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)
[ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)
[ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)
[ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)
[ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq
[ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq
[ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036)
[ 88.810950] tbf_reset (./include/linux/timekeeping.h:169 net/sched/sch_tbf.c:334) sch_tbf
[ 88.811208] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036)
[ 88.811484] netif_set_real_num_tx_queues (./include/linux/spinlock.h:396 ./include/net/sch_generic.h:768 net/core/dev.c:2958)
[ 88.811870] __tun_detach (drivers/net/tun.c:590 drivers/net/tun.c:673)
[ 88.812271] tun_chr_close (drivers/net/tun.c:702 drivers/net/tun.c:3517)
[ 88.812505] __fput (fs/file_table.c:432 (discriminator 1))
[ 88.812735] task_work_run (kernel/task_work.c:230)
[ 88.813016] do_exit (kernel/exit.c:940)
[ 88.813372] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4))
[ 88.813639] ? handle_mm_fault (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/memcontrol.h:1022 ./include/linux/memcontrol.h:1045 ./include/linux/memcontrol.h:1052 mm/memory.c:5928 mm/memory.c:6088)
[ 88.813867] do_group_exit (kernel/exit.c:1070)
[ 88.814138] __x64_sys_exit_group (kernel/exit.c:1099)
[ 88.814490] x64_sys_call (??:?)
[ 88.814791] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))
[ 88.815012] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 88.815495] RIP: 0033:0x7f44560f1975
Fixes: 175f9c1bba ("net_sched: Add size table for qdiscs")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20241007184130.3960565-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-10-08 15:38:56 -07:00
..
2024-05-01 18:07:37 +01:00
2024-10-02 17:23:23 -04:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:22 -07:00
2024-09-09 13:15:37 -07:00
2024-09-05 20:37:20 -07:00
2024-10-02 17:23:23 -04:00
2024-08-30 11:14:06 -07:00
2024-08-26 09:37:23 -07:00
2024-09-11 20:44:31 -07:00
2023-06-15 22:33:26 -07:00
2024-08-26 09:37:23 -07:00
2024-01-02 12:41:16 +00:00
2024-02-02 10:57:55 -08:00
2024-08-26 09:37:23 -07:00
2023-12-24 15:22:50 +00:00
2024-06-25 11:10:18 +02:00
2024-08-15 17:18:52 -07:00
2022-07-22 12:53:22 +01:00
2023-03-21 21:32:18 -07:00
2024-05-14 10:53:19 -07:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2024-08-26 09:37:22 -07:00
2024-08-26 09:37:22 -07:00
2024-02-06 13:17:54 +01:00
2024-08-27 13:11:37 -07:00
2021-03-26 17:43:55 +01:00
2024-08-29 11:49:10 -07:00
2024-10-02 17:23:23 -04:00
2022-11-16 11:31:47 +02:00
2024-09-09 11:04:25 +02:00
2024-03-06 21:01:26 +01:00
2023-01-27 11:19:46 +00:00
2024-10-02 17:23:23 -04:00
2021-12-22 15:03:47 -08:00
2022-07-22 12:53:22 +01:00
2023-07-14 20:39:29 -07:00
2022-07-24 18:39:17 -06:00
2023-07-27 17:17:32 -07:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2024-06-05 10:24:57 +01:00
2024-08-26 09:37:23 -07:00
2023-08-14 08:01:06 +01:00
2023-10-24 13:08:14 -07:00
2024-08-16 09:59:32 +01:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-08-20 15:22:17 -07:00
2024-05-29 17:34:49 -07:00
2024-08-26 09:37:23 -07:00
2024-03-05 19:21:17 -08:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-04-01 21:27:08 -07:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2024-01-03 16:42:48 -08:00
2022-07-28 22:21:54 -07:00
2024-07-15 09:14:39 -07:00
2024-06-12 17:56:00 -07:00
2023-11-02 09:31:02 +01:00
2023-04-12 16:40:39 -07:00
2022-12-01 15:09:10 +01:00
2023-08-08 15:58:23 -07:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2024-04-01 21:44:34 -07:00
2022-10-31 10:43:04 +00:00
2024-04-01 10:49:28 +01:00
2024-05-14 10:49:50 -07:00
2023-06-10 00:11:41 -07:00
2024-05-07 01:35:55 +02:00
2022-07-22 12:53:22 +01:00
2023-07-28 14:07:59 -07:00
2024-04-30 18:46:52 -07:00
2024-08-26 09:37:23 -07:00
2021-06-28 14:29:45 -07:00
2024-05-08 10:35:09 +01:00
2024-10-02 17:23:23 -04:00
2023-11-20 11:43:03 +01:00
2024-02-26 18:40:34 -08:00
2022-07-22 12:53:22 +01:00
2024-08-05 16:27:26 -07:00
2024-05-13 18:19:09 -06:00
2024-06-25 11:37:45 +02:00
2022-02-07 20:12:45 -08:00
2021-10-15 11:33:08 +01:00
2024-05-23 14:14:23 -07:00
2024-08-05 16:22:45 -07:00
2024-08-05 16:22:45 -07:00
2024-08-28 17:08:16 -07:00
2024-02-28 11:19:41 +00:00
2021-11-16 13:16:54 +00:00
2024-04-29 13:32:01 +01:00
2024-07-14 07:34:16 -07:00
2024-04-01 10:49:28 +01:00
2024-09-04 16:40:33 -07:00
2024-08-26 09:37:22 -07:00
2023-04-22 01:39:41 +02:00
2024-08-31 17:44:51 +01:00
2022-09-29 07:18:00 +02:00
2022-07-22 12:53:22 +01:00
2022-10-31 20:14:27 -07:00
2024-08-05 16:27:26 -07:00
2024-08-26 09:37:22 -07:00
2024-09-03 11:49:27 +02:00
2024-08-19 18:36:12 -07:00
2021-03-23 14:14:50 -07:00
2024-08-27 10:28:49 +02:00
2023-08-04 15:33:17 -07:00
2023-08-04 15:33:17 -07:00
2024-07-15 08:51:01 -07:00
2023-07-20 10:46:28 +02:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2024-07-15 08:51:19 -07:00
2021-11-07 19:25:29 +00:00
2023-08-18 16:05:26 +02:00
2024-10-02 17:23:23 -04:00
2024-10-02 17:23:23 -04:00
2024-04-25 08:20:54 -07:00
2024-02-29 14:24:56 -08:00
2021-10-29 13:23:51 +01:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2024-09-11 15:57:50 -07:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2024-08-12 17:23:57 -07:00
2024-07-24 20:59:29 +02:00
2022-05-11 12:43:10 +01:00
2024-08-03 22:38:44 +01:00
2021-12-10 06:38:26 -08:00
2024-06-01 15:11:52 -07:00
2024-09-12 21:00:26 -07:00
2022-07-22 12:53:22 +01:00
2023-11-20 10:15:16 -08:00
2024-08-26 09:37:22 -07:00
2024-08-26 09:37:23 -07:00
2024-09-11 20:44:31 -07:00
2022-07-22 12:53:22 +01:00
2024-08-12 17:50:34 -07:00
2024-08-30 22:30:55 +02:00
2023-07-14 20:39:29 -07:00
2023-08-04 15:33:50 -07:00
2024-04-01 10:49:28 +01:00
2023-07-14 20:39:30 -07:00
2023-06-02 09:55:22 +01:00
2024-08-26 09:37:23 -07:00
2024-02-02 10:57:55 -08:00
2022-07-22 12:53:22 +01:00
2024-04-30 18:46:52 -07:00
2024-03-07 21:12:43 -08:00
2024-07-11 18:11:31 -07:00
2022-07-22 12:53:22 +01:00
2023-04-06 12:01:20 -07:00
2023-03-17 08:56:37 +00:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2024-06-06 15:18:04 +02:00
2022-08-01 11:59:23 -07:00
2024-08-31 17:44:51 +01:00
2023-06-19 11:32:58 -07:00
2024-04-01 11:28:32 +01:00
2023-07-14 20:39:30 -07:00
2024-08-07 10:24:46 +01:00
2024-06-05 12:34:54 +01:00
2024-10-08 15:38:56 -07:00
2024-05-10 18:52:45 -07:00
2022-07-22 12:53:22 +01:00
2024-05-30 18:29:38 -07:00
2024-06-24 16:41:23 -07:00
2024-05-30 18:29:38 -07:00
2021-04-28 14:06:45 -07:00
2024-04-30 13:24:48 +02:00
2024-08-02 17:16:59 -07:00
2024-10-04 15:37:15 -07:00
2023-10-04 11:49:20 -07:00
2022-07-22 12:53:22 +01:00
2022-07-18 11:24:10 +01:00
2024-02-16 09:36:37 +00:00
2024-02-14 10:49:37 +01:00
2024-06-12 06:39:04 +01:00
2023-12-04 14:45:26 -08:00
2024-09-23 11:43:09 +01:00
2024-07-08 14:07:31 -07:00
2024-05-09 20:25:55 -07:00
2023-07-28 14:07:59 -07:00
2024-04-25 12:41:37 -07:00
2023-08-01 15:06:27 -07:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2024-04-01 10:49:28 +01:00
2024-08-26 09:37:23 -07:00
2023-09-14 16:16:36 +02:00
2023-11-16 22:33:31 +00:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-05-08 08:51:20 +02:00
2024-07-02 15:26:57 +02:00
2023-12-14 16:38:59 +01:00
2024-08-28 07:37:13 +02:00
2024-05-08 08:51:20 +02:00