| From 9ab1e97c75a564d485b601c70e0aca212ac9e56b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 18 Oct 2022 14:31:59 +0800 |
| Subject: net: sched: cake: fix null pointer access issue when cake_init() |
| fails |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Zhengchao Shao <shaozhengchao@huawei.com> |
| |
| [ Upstream commit 51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb ] |
| |
| When the default qdisc is cake, if the qdisc of dev_queue fails to be |
| inited during mqprio_init(), cake_reset() is invoked to clear |
| resources. In this case, the tins is NULL, and it will cause gpf issue. |
| |
| The process is as follows: |
| qdisc_create_dflt() |
| cake_init() |
| q->tins = kvcalloc(...) --->failed, q->tins is NULL |
| ... |
| qdisc_put() |
| ... |
| cake_reset() |
| ... |
| cake_dequeue_one() |
| b = &q->tins[...] --->q->tins is NULL |
| |
| The following is the Call Trace information: |
| general protection fault, probably for non-canonical address |
| 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN |
| KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] |
| RIP: 0010:cake_dequeue_one+0xc9/0x3c0 |
| Call Trace: |
| <TASK> |
| cake_reset+0xb1/0x140 |
| qdisc_reset+0xed/0x6f0 |
| qdisc_destroy+0x82/0x4c0 |
| qdisc_put+0x9e/0xb0 |
| qdisc_create_dflt+0x2c3/0x4a0 |
| mqprio_init+0xa71/0x1760 |
| qdisc_create+0x3eb/0x1000 |
| tc_modify_qdisc+0x408/0x1720 |
| rtnetlink_rcv_msg+0x38e/0xac0 |
| netlink_rcv_skb+0x12d/0x3a0 |
| netlink_unicast+0x4a2/0x740 |
| netlink_sendmsg+0x826/0xcc0 |
| sock_sendmsg+0xc5/0x100 |
| ____sys_sendmsg+0x583/0x690 |
| ___sys_sendmsg+0xe8/0x160 |
| __sys_sendmsg+0xbf/0x160 |
| do_syscall_64+0x35/0x80 |
| entry_SYSCALL_64_after_hwframe+0x46/0xb0 |
| RIP: 0033:0x7f89e5122d04 |
| </TASK> |
| |
| Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") |
| Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> |
| Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/sched/sch_cake.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c |
| index 857aaebd49f4..6f6e74ce927f 100644 |
| --- a/net/sched/sch_cake.c |
| +++ b/net/sched/sch_cake.c |
| @@ -2224,8 +2224,12 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) |
| |
| static void cake_reset(struct Qdisc *sch) |
| { |
| + struct cake_sched_data *q = qdisc_priv(sch); |
| u32 c; |
| |
| + if (!q->tins) |
| + return; |
| + |
| for (c = 0; c < CAKE_MAX_TINS; c++) |
| cake_clear_tin(sch, c); |
| } |
| -- |
| 2.35.1 |
| |
