From: Davide Caratti <dcara...@redhat.com>
Date: Fri, 29 May 2020 00:05:32 +0200
> trying to configure TC 'act_gate' rules with invalid control actions, the
> following splat can be observed:
>
> general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168
> Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab
> 04/01/2014
> RIP: 0010:hrtimer_active+0x56/0x290
> [...]
> Call Trace:
> hrtimer_try_to_cancel+0x6d/0x330
...
> this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> ensuring to call hrtimer_cancel() only if clockid is valid, and the timer
> has been initialized. After fixing this splat, the same error path causes
> another problem:
>
> general protection fault, probably for non-canonical address
> 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168
> Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab
> 04/01/2014
> RIP: 0010:release_entry_list+0x4a/0x240 [act_gate]
> [...]
> Call Trace:
> tcf_action_cleanup+0x58/0x170
...
> the problem is similar: tcf_action_cleanup() was trying to release a list
> without initializing it first. Ensure that INIT_LIST_HEAD() is called for
> every newly created 'act_gate' action, same as what was done to 'act_ife'
> with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
> earlier").
>
> Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
> CC: Ivan Vecera <ivec...@redhat.com>
> Signed-off-by: Davide Caratti <dcara...@redhat.com>
Applied, thanks.
