mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-19 17:58:41 +07:00
38230a3e0e
the control action in the common member of struct tcf_tunnel_key must be a
valid value, as it can contain the chain index when 'goto chain' is used.
Ensure that the control action can be read as x->tcfa_action, when x is a
pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to
prevent the following command:
# tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
> $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1
from causing a NULL dereference when a matching packet is received:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 3491 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421
Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Call Trace:
<IRQ>
fl_classify+0x1ad/0x1c0 [cls_flower]
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? update_load_avg+0x665/0x690
? update_load_avg+0x665/0x690
? kmem_cache_alloc+0x38/0x1c0
tcf_classify+0x89/0x140
__netif_receive_skb_core+0x5ea/0xb70
? enqueue_entity+0xd0/0x270
? process_backlog+0x97/0x150
process_backlog+0x97/0x150
net_rx_action+0x14b/0x3e0
__do_softirq+0xde/0x2b4
do_softirq_own_stack+0x2a/0x40
</IRQ>
do_softirq.part.18+0x49/0x50
__local_bh_enable_ip+0x49/0x50
__dev_queue_xmit+0x4ab/0x8a0
? wait_woken+0x80/0x80
? packet_sendmsg+0x38f/0x810
? __dev_queue_xmit+0x8a0/0x8a0
packet_sendmsg+0x38f/0x810
sock_sendmsg+0x36/0x40
__sys_sendto+0x10e/0x140
? do_vfs_ioctl+0xa4/0x630
? syscall_trace_enter+0x1df/0x2e0
? __audit_syscall_exit+0x22a/0x290
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x5b/0x180
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fd67e18dc93
Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93
RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003
RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003
Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me
mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca
CR2: 0000000000000000
---[ end trace 1ab8b5b5d4639dfc ]---
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Fixes: d0f6dd8a91
("net/sched: Introduce act_tunnel_key")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
360 lines
9.2 KiB
C
360 lines
9.2 KiB
C
/*
|
|
* Copyright (c) 2016, Amir Vadai <amir@vadai.me>
|
|
* Copyright (c) 2016, Mellanox Technologies. All rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/rtnetlink.h>
|
|
#include <net/netlink.h>
|
|
#include <net/pkt_sched.h>
|
|
#include <net/dst.h>
|
|
|
|
#include <linux/tc_act/tc_tunnel_key.h>
|
|
#include <net/tc_act/tc_tunnel_key.h>
|
|
|
|
static unsigned int tunnel_key_net_id;
|
|
static struct tc_action_ops act_tunnel_key_ops;
|
|
|
|
static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
|
|
struct tcf_result *res)
|
|
{
|
|
struct tcf_tunnel_key *t = to_tunnel_key(a);
|
|
struct tcf_tunnel_key_params *params;
|
|
int action;
|
|
|
|
rcu_read_lock();
|
|
|
|
params = rcu_dereference(t->params);
|
|
|
|
tcf_lastuse_update(&t->tcf_tm);
|
|
bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
|
|
action = READ_ONCE(t->tcf_action);
|
|
|
|
switch (params->tcft_action) {
|
|
case TCA_TUNNEL_KEY_ACT_RELEASE:
|
|
skb_dst_drop(skb);
|
|
break;
|
|
case TCA_TUNNEL_KEY_ACT_SET:
|
|
skb_dst_drop(skb);
|
|
skb_dst_set(skb, dst_clone(¶ms->tcft_enc_metadata->dst));
|
|
break;
|
|
default:
|
|
WARN_ONCE(1, "Bad tunnel_key action %d.\n",
|
|
params->tcft_action);
|
|
break;
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
|
|
return action;
|
|
}
|
|
|
|
static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = {
|
|
[TCA_TUNNEL_KEY_PARMS] = { .len = sizeof(struct tc_tunnel_key) },
|
|
[TCA_TUNNEL_KEY_ENC_IPV4_SRC] = { .type = NLA_U32 },
|
|
[TCA_TUNNEL_KEY_ENC_IPV4_DST] = { .type = NLA_U32 },
|
|
[TCA_TUNNEL_KEY_ENC_IPV6_SRC] = { .len = sizeof(struct in6_addr) },
|
|
[TCA_TUNNEL_KEY_ENC_IPV6_DST] = { .len = sizeof(struct in6_addr) },
|
|
[TCA_TUNNEL_KEY_ENC_KEY_ID] = { .type = NLA_U32 },
|
|
[TCA_TUNNEL_KEY_ENC_DST_PORT] = {.type = NLA_U16},
|
|
[TCA_TUNNEL_KEY_NO_CSUM] = { .type = NLA_U8 },
|
|
};
|
|
|
|
static int tunnel_key_init(struct net *net, struct nlattr *nla,
|
|
struct nlattr *est, struct tc_action **a,
|
|
int ovr, int bind, struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
|
|
struct nlattr *tb[TCA_TUNNEL_KEY_MAX + 1];
|
|
struct tcf_tunnel_key_params *params_old;
|
|
struct tcf_tunnel_key_params *params_new;
|
|
struct metadata_dst *metadata = NULL;
|
|
struct tc_tunnel_key *parm;
|
|
struct tcf_tunnel_key *t;
|
|
bool exists = false;
|
|
__be16 dst_port = 0;
|
|
__be64 key_id;
|
|
__be16 flags;
|
|
int ret = 0;
|
|
int err;
|
|
|
|
if (!nla)
|
|
return -EINVAL;
|
|
|
|
err = nla_parse_nested(tb, TCA_TUNNEL_KEY_MAX, nla, tunnel_key_policy,
|
|
NULL);
|
|
if (err < 0)
|
|
return err;
|
|
|
|
if (!tb[TCA_TUNNEL_KEY_PARMS])
|
|
return -EINVAL;
|
|
|
|
parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]);
|
|
exists = tcf_idr_check(tn, parm->index, a, bind);
|
|
if (exists && bind)
|
|
return 0;
|
|
|
|
switch (parm->t_action) {
|
|
case TCA_TUNNEL_KEY_ACT_RELEASE:
|
|
break;
|
|
case TCA_TUNNEL_KEY_ACT_SET:
|
|
if (!tb[TCA_TUNNEL_KEY_ENC_KEY_ID]) {
|
|
ret = -EINVAL;
|
|
goto err_out;
|
|
}
|
|
|
|
key_id = key32_to_tunnel_id(nla_get_be32(tb[TCA_TUNNEL_KEY_ENC_KEY_ID]));
|
|
|
|
flags = TUNNEL_KEY | TUNNEL_CSUM;
|
|
if (tb[TCA_TUNNEL_KEY_NO_CSUM] &&
|
|
nla_get_u8(tb[TCA_TUNNEL_KEY_NO_CSUM]))
|
|
flags &= ~TUNNEL_CSUM;
|
|
|
|
if (tb[TCA_TUNNEL_KEY_ENC_DST_PORT])
|
|
dst_port = nla_get_be16(tb[TCA_TUNNEL_KEY_ENC_DST_PORT]);
|
|
|
|
if (tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC] &&
|
|
tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]) {
|
|
__be32 saddr;
|
|
__be32 daddr;
|
|
|
|
saddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_SRC]);
|
|
daddr = nla_get_in_addr(tb[TCA_TUNNEL_KEY_ENC_IPV4_DST]);
|
|
|
|
metadata = __ip_tun_set_dst(saddr, daddr, 0, 0,
|
|
dst_port, flags,
|
|
key_id, 0);
|
|
} else if (tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC] &&
|
|
tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]) {
|
|
struct in6_addr saddr;
|
|
struct in6_addr daddr;
|
|
|
|
saddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC]);
|
|
daddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]);
|
|
|
|
metadata = __ipv6_tun_set_dst(&saddr, &daddr, 0, 0, dst_port,
|
|
0, flags,
|
|
key_id, 0);
|
|
}
|
|
|
|
if (!metadata) {
|
|
ret = -EINVAL;
|
|
goto err_out;
|
|
}
|
|
|
|
metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
|
|
break;
|
|
default:
|
|
ret = -EINVAL;
|
|
goto err_out;
|
|
}
|
|
|
|
if (!exists) {
|
|
ret = tcf_idr_create(tn, parm->index, est, a,
|
|
&act_tunnel_key_ops, bind, true);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = ACT_P_CREATED;
|
|
} else {
|
|
tcf_idr_release(*a, bind);
|
|
if (!ovr)
|
|
return -EEXIST;
|
|
}
|
|
|
|
t = to_tunnel_key(*a);
|
|
|
|
ASSERT_RTNL();
|
|
params_new = kzalloc(sizeof(*params_new), GFP_KERNEL);
|
|
if (unlikely(!params_new)) {
|
|
if (ret == ACT_P_CREATED)
|
|
tcf_idr_release(*a, bind);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
params_old = rtnl_dereference(t->params);
|
|
|
|
t->tcf_action = parm->action;
|
|
params_new->tcft_action = parm->t_action;
|
|
params_new->tcft_enc_metadata = metadata;
|
|
|
|
rcu_assign_pointer(t->params, params_new);
|
|
|
|
if (params_old)
|
|
kfree_rcu(params_old, rcu);
|
|
|
|
if (ret == ACT_P_CREATED)
|
|
tcf_idr_insert(tn, *a);
|
|
|
|
return ret;
|
|
|
|
err_out:
|
|
if (exists)
|
|
tcf_idr_release(*a, bind);
|
|
return ret;
|
|
}
|
|
|
|
static void tunnel_key_release(struct tc_action *a)
|
|
{
|
|
struct tcf_tunnel_key *t = to_tunnel_key(a);
|
|
struct tcf_tunnel_key_params *params;
|
|
|
|
params = rcu_dereference_protected(t->params, 1);
|
|
if (params) {
|
|
if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
|
|
dst_release(¶ms->tcft_enc_metadata->dst);
|
|
|
|
kfree_rcu(params, rcu);
|
|
}
|
|
}
|
|
|
|
static int tunnel_key_dump_addresses(struct sk_buff *skb,
|
|
const struct ip_tunnel_info *info)
|
|
{
|
|
unsigned short family = ip_tunnel_info_af(info);
|
|
|
|
if (family == AF_INET) {
|
|
__be32 saddr = info->key.u.ipv4.src;
|
|
__be32 daddr = info->key.u.ipv4.dst;
|
|
|
|
if (!nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_SRC, saddr) &&
|
|
!nla_put_in_addr(skb, TCA_TUNNEL_KEY_ENC_IPV4_DST, daddr))
|
|
return 0;
|
|
}
|
|
|
|
if (family == AF_INET6) {
|
|
const struct in6_addr *saddr6 = &info->key.u.ipv6.src;
|
|
const struct in6_addr *daddr6 = &info->key.u.ipv6.dst;
|
|
|
|
if (!nla_put_in6_addr(skb,
|
|
TCA_TUNNEL_KEY_ENC_IPV6_SRC, saddr6) &&
|
|
!nla_put_in6_addr(skb,
|
|
TCA_TUNNEL_KEY_ENC_IPV6_DST, daddr6))
|
|
return 0;
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
|
|
int bind, int ref)
|
|
{
|
|
unsigned char *b = skb_tail_pointer(skb);
|
|
struct tcf_tunnel_key *t = to_tunnel_key(a);
|
|
struct tcf_tunnel_key_params *params;
|
|
struct tc_tunnel_key opt = {
|
|
.index = t->tcf_index,
|
|
.refcnt = t->tcf_refcnt - ref,
|
|
.bindcnt = t->tcf_bindcnt - bind,
|
|
.action = t->tcf_action,
|
|
};
|
|
struct tcf_t tm;
|
|
|
|
params = rtnl_dereference(t->params);
|
|
|
|
opt.t_action = params->tcft_action;
|
|
|
|
if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
|
|
goto nla_put_failure;
|
|
|
|
if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) {
|
|
struct ip_tunnel_key *key =
|
|
¶ms->tcft_enc_metadata->u.tun_info.key;
|
|
__be32 key_id = tunnel_id_to_key32(key->tun_id);
|
|
|
|
if (nla_put_be32(skb, TCA_TUNNEL_KEY_ENC_KEY_ID, key_id) ||
|
|
tunnel_key_dump_addresses(skb,
|
|
¶ms->tcft_enc_metadata->u.tun_info) ||
|
|
nla_put_be16(skb, TCA_TUNNEL_KEY_ENC_DST_PORT, key->tp_dst) ||
|
|
nla_put_u8(skb, TCA_TUNNEL_KEY_NO_CSUM,
|
|
!(key->tun_flags & TUNNEL_CSUM)))
|
|
goto nla_put_failure;
|
|
}
|
|
|
|
tcf_tm_dump(&tm, &t->tcf_tm);
|
|
if (nla_put_64bit(skb, TCA_TUNNEL_KEY_TM, sizeof(tm),
|
|
&tm, TCA_TUNNEL_KEY_PAD))
|
|
goto nla_put_failure;
|
|
|
|
return skb->len;
|
|
|
|
nla_put_failure:
|
|
nlmsg_trim(skb, b);
|
|
return -1;
|
|
}
|
|
|
|
static int tunnel_key_walker(struct net *net, struct sk_buff *skb,
|
|
struct netlink_callback *cb, int type,
|
|
const struct tc_action_ops *ops,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
|
|
|
|
return tcf_generic_walker(tn, skb, cb, type, ops, extack);
|
|
}
|
|
|
|
static int tunnel_key_search(struct net *net, struct tc_action **a, u32 index,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
|
|
|
|
return tcf_idr_search(tn, a, index);
|
|
}
|
|
|
|
static struct tc_action_ops act_tunnel_key_ops = {
|
|
.kind = "tunnel_key",
|
|
.type = TCA_ACT_TUNNEL_KEY,
|
|
.owner = THIS_MODULE,
|
|
.act = tunnel_key_act,
|
|
.dump = tunnel_key_dump,
|
|
.init = tunnel_key_init,
|
|
.cleanup = tunnel_key_release,
|
|
.walk = tunnel_key_walker,
|
|
.lookup = tunnel_key_search,
|
|
.size = sizeof(struct tcf_tunnel_key),
|
|
};
|
|
|
|
static __net_init int tunnel_key_init_net(struct net *net)
|
|
{
|
|
struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
|
|
|
|
return tc_action_net_init(tn, &act_tunnel_key_ops);
|
|
}
|
|
|
|
static void __net_exit tunnel_key_exit_net(struct list_head *net_list)
|
|
{
|
|
tc_action_net_exit(net_list, tunnel_key_net_id);
|
|
}
|
|
|
|
static struct pernet_operations tunnel_key_net_ops = {
|
|
.init = tunnel_key_init_net,
|
|
.exit_batch = tunnel_key_exit_net,
|
|
.id = &tunnel_key_net_id,
|
|
.size = sizeof(struct tc_action_net),
|
|
};
|
|
|
|
static int __init tunnel_key_init_module(void)
|
|
{
|
|
return tcf_register_action(&act_tunnel_key_ops, &tunnel_key_net_ops);
|
|
}
|
|
|
|
static void __exit tunnel_key_cleanup_module(void)
|
|
{
|
|
tcf_unregister_action(&act_tunnel_key_ops, &tunnel_key_net_ops);
|
|
}
|
|
|
|
module_init(tunnel_key_init_module);
|
|
module_exit(tunnel_key_cleanup_module);
|
|
|
|
MODULE_AUTHOR("Amir Vadai <amir@vadai.me>");
|
|
MODULE_DESCRIPTION("ip tunnel manipulation actions");
|
|
MODULE_LICENSE("GPL v2");
|