Hi Davide,
> -----Original Message-----
> From: Davide Caratti <dcara...@redhat.com>
> Sent: 2020年5月29日 6:06
> To: Jamal Hadi Salim <j...@mojatatu.com>; Po Liu <po....@nxp.com>;
> netdev@vger.kernel.org; David S. Miller <da...@davemloft.net>
> Cc: Ivan Vecera <ivec...@redhat.com>
> Subject: [PATCH net-next] net/sched: fix a couple of splats in the
> error path of tfc_gate_init()
>
> trying to configure TC 'act_gate' rules with invalid control actions, the
> following splat can be observed:
>
> general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000010-
> 0x0000000000000017]
> CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168 Hardware name:
> Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
> RIP: 0010:hrtimer_active+0x56/0x290
> [...]
> Call Trace:
> hrtimer_try_to_cancel+0x6d/0x330
> hrtimer_cancel+0x11/0x20
> tcf_gate_cleanup+0x15/0x30 [act_gate]
> tcf_action_cleanup+0x58/0x170
> __tcf_action_put+0xb0/0xe0
> __tcf_idr_release+0x68/0x90
> tcf_gate_init+0x7c7/0x19a0 [act_gate]
> tcf_action_init_1+0x60f/0x960
> tcf_action_init+0x157/0x2a0
> tcf_action_add+0xd9/0x2f0
> tc_ctl_action+0x2a3/0x39d
> rtnetlink_rcv_msg+0x5f3/0x920
> netlink_rcv_skb+0x121/0x350
> netlink_unicast+0x439/0x630
> netlink_sendmsg+0x714/0xbf0
> sock_sendmsg+0xe2/0x110
> ____sys_sendmsg+0x5b4/0x890
> ___sys_sendmsg+0xe9/0x160
> __sys_sendmsg+0xd3/0x170
> do_syscall_64+0x9a/0x370
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> ensuring to call hrtimer_cancel() only if clockid is valid, and the timer has
Can you share the test step? Clockid by default is set with CLOCK_TAI. And
INIT_LIST_HEAD() also called in the init.
So I think maybe there is better method to avoid the duplicated code.
> been initialized. After fixing this splat, the same error path causes another
> problem:
>
> general protection fault, probably for non-canonical address
> 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000000-
> 0x0000000000000007]
> CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168 Hardware name:
> Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
> RIP: 0010:release_entry_list+0x4a/0x240 [act_gate] [...] Call Trace:
> tcf_action_cleanup+0x58/0x170
> __tcf_action_put+0xb0/0xe0
> __tcf_idr_release+0x68/0x90
> tcf_gate_init+0x7ab/0x19a0 [act_gate]
> tcf_action_init_1+0x60f/0x960
> tcf_action_init+0x157/0x2a0
> tcf_action_add+0xd9/0x2f0
> tc_ctl_action+0x2a3/0x39d
> rtnetlink_rcv_msg+0x5f3/0x920
> netlink_rcv_skb+0x121/0x350
> netlink_unicast+0x439/0x630
> netlink_sendmsg+0x714/0xbf0
> sock_sendmsg+0xe2/0x110
> ____sys_sendmsg+0x5b4/0x890
> ___sys_sendmsg+0xe9/0x160
> __sys_sendmsg+0xd3/0x170
> do_syscall_64+0x9a/0x370
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> the problem is similar: tcf_action_cleanup() was trying to release a list
> without initializing it first. Ensure that INIT_LIST_HEAD() is called for
> every
> newly created 'act_gate' action, same as what was done to 'act_ife'
> with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
> earlier").
>
> Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
> CC: Ivan Vecera <ivec...@redhat.com>
> Signed-off-by: Davide Caratti <dcara...@redhat.com>
> ---
> net/sched/act_gate.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c index
> 35fc48795541c..9c628591f452c 100644
> --- a/net/sched/act_gate.c
> +++ b/net/sched/act_gate.c
> @@ -331,6 +331,10 @@ static int tcf_gate_init(struct net *net, struct
> nlattr *nla,
> tcf_idr_release(*a, bind);
> return -EEXIST;
> }
> + if (ret == ACT_P_CREATED) {
> + to_gate(*a)->param.tcfg_clockid = -1;
> + INIT_LIST_HEAD(&(to_gate(*a)->param.entries));
> + }
>
> if (tb[TCA_GATE_PRIORITY])
> prio = nla_get_s32(tb[TCA_GATE_PRIORITY]);
> @@ -377,7 +381,6 @@ static int tcf_gate_init(struct net *net, struct nlattr
> *nla,
> goto chain_put;
> }
>
> - INIT_LIST_HEAD(&p->entries);
> if (tb[TCA_GATE_ENTRY_LIST]) {
> err = parse_gate_list(tb[TCA_GATE_ENTRY_LIST], p, extack);
> if (err < 0)
> @@ -449,9 +452,9 @@ static void tcf_gate_cleanup(struct tc_action *a)
> struct tcf_gate *gact = to_gate(a);
> struct tcf_gate_params *p;
>
> - hrtimer_cancel(&gact->hitimer);
> -
> p = &gact->param;
> + if (p->tcfg_clockid != -1)
> + hrtimer_cancel(&gact->hitimer);
>
> release_entry_list(&p->entries); }
> --
> 2.26.2
Thanks!
Br,
Po Liu
