From nobody Sat Apr 27 01:55:22 2024 Delivered-To: wpasupplicant.patchew@gmail.com Received: by 2002:a05:6a06:869:b0:4b8:7781:bd2f with SMTP id d41csp1254779pis; Thu, 5 May 2022 08:36:32 -0700 (PDT) X-Google-Smtp-Source: ABdhPJynhEZj98+kScM5zRILVNMgc9HBEeP/1OYo4q8/lB6pS3hEei1KIPMK8cyj8kpqDWVKn/jK X-Received: by 2002:a05:6808:1aa5:b0:325:bbb7:8dcf with SMTP id bm37-20020a0568081aa500b00325bbb78dcfmr2749387oib.283.1651764992164; Thu, 05 May 2022 08:36:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651764992; cv=none; d=google.com; s=arc-20160816; b=0qGxNXiNiEQswC3aj3Cy70wrgevkf8b8AHjfQtmTeNlmdOHae0yhPgApD6XFBiCXrG xoq/+EX9qalOmiiOzW99ODkScLiSzJlv9CpN0uTpWMCh+FO3VpHK4rSYQ9ksSYf8FYTJ V+/VU98FaGNF5TGXk151x2f5WFoMtwy3U622Kj5foTi2qK+fdS02zFtCFgYT+hlw/zLU qhpBqpnrrWxKeI8PZDlSI6lts4i8vhQLdCLlCcQTq2G4Co5Mx9RkxX4bO/giO6G2bOCB Hz+qJ2J1xXQa/yJPGS264KlsL707jQrSJlhR3S9NrzGCWSD1rX4yTOv0wT0dKcvqh0h+ dWOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:to:from :dkim-signature; bh=NjzztI/g3DGpwECMhfn49droPq5TshiT2QY7OqVjf5E=; b=SG8LyjJ4E+QgpNQvrU8rOMUjDC2s03KeHPu3Z948+ol0zlq2rDXz7tSX5aEoQnIQhf 0TT2R21e0ErzW4Kc4DCYi+tbxw9WcApJ+lQzcJn7H7iuDrdWfTIKk7kpNXPhrrvmbuId t8zKYglUHijdLWzCkZJpvxHuPAHp3askvGh9jR0g+n274RB4S/l07Q3M1CCDY8zmOjED Ivi6y0jlpr6jDqhEYHkPGkrNsOIXNTp8NgOpYk1U0+xds3C/gLvYaMTjpagHxJitC57n 4iH0CpLRdRqMc1eZNaZugovb9UCgxxwCYhk3LnVgvrfMYynXYUoZnySsPYEFwFyYOnGD 8BdA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=Cq90HY8t; spf=pass (google.com: domain of mptcp+bounces-5139-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.88.99 as permitted sender) smtp.mailfrom="mptcp+bounces-5139-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id h20-20020a9d6f94000000b00605e0f564a0si1195533otq.252.2022.05.05.08.36.32 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 May 2022 08:36:32 -0700 (PDT) Received-SPF: pass (google.com: domain of mptcp+bounces-5139-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=Cq90HY8t; spf=pass (google.com: domain of mptcp+bounces-5139-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.88.99 as permitted sender) smtp.mailfrom="mptcp+bounces-5139-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 0211D280A63 for ; Thu, 5 May 2022 15:36:31 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1DA992575; Thu, 5 May 2022 15:36:30 +0000 (UTC) X-Original-To: mptcp@lists.linux.dev Received: from us-smtp-delivery-74.mimecast.com (us-smtp-delivery-74.mimecast.com [170.10.129.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 433C02568 for ; Thu, 5 May 2022 15:36:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1651764987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=NjzztI/g3DGpwECMhfn49droPq5TshiT2QY7OqVjf5E=; b=Cq90HY8tGPiLPey2xJbMlDMGIgjdY0dtRRPs741LEIrtzrjCwjGFOyx2U87U4jL3vsM8Ub /opP/erDhD75eQoExpCm+NFLG9b+uiQNolEq7rswgryZnK/IfzpRT/cp0Yc5utiFf6J3nY v5PwAb28qHaxsmP2UtCUU51U301T9f0= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-397-mZu_9UDkMCq0wnougO783Q-1; Thu, 05 May 2022 11:36:26 -0400 X-MC-Unique: mZu_9UDkMCq0wnougO783Q-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id D1E1529ABA3B for ; Thu, 5 May 2022 15:36:25 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.39.194.241]) by smtp.corp.redhat.com (Postfix) with ESMTP id 613B540CF8F5 for ; Thu, 5 May 2022 15:36:25 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Subject: [PATCH net] net/sched: act_pedit: really ensure the skb is writable Date: Thu, 5 May 2022 17:36:21 +0200 Message-Id: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=pabeni@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" Currently pedit tries to ensure that the accessed skb offset is writeble via skb_unclone(). The action potentially allows touching any skb bytes, so it may end-up modifying shared data. The above causes some sporadic MPTCP self-test failures. Address the issue keeping track of a rough over-estimate highest skb offset accessed by the action and ensure such offset is really writable. Note that this may cause performance regressions in some scenario, but hopefully pedit is not critical path. v1 -> v2: - cleanup hint update (Jakub) - avoid raices while accessing the hint (Jakub) - re-organize the comments for clarity Fixes: db2c24175d14 ("act_pedit: access skb->data safely") Acked-by: Mat Martineau Tested-by: Geliang Tang Signed-off-by: Paolo Abeni --- include/net/tc_act/tc_pedit.h | 1 + net/sched/act_pedit.c | 25 +++++++++++++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h index 748cf87a4d7e..3e02709a1df6 100644 --- a/include/net/tc_act/tc_pedit.h +++ b/include/net/tc_act/tc_pedit.h @@ -14,6 +14,7 @@ struct tcf_pedit { struct tc_action common; unsigned char tcfp_nkeys; unsigned char tcfp_flags; + u32 tcfp_off_max_hint; struct tc_pedit_key *tcfp_keys; struct tcf_pedit_key_ex *tcfp_keys_ex; }; diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index e01ef7f109f4..0fc07532e6f6 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c @@ -149,7 +149,7 @@ static int tcf_pedit_init(struct net *net, struct nlatt= r *nla, struct nlattr *pattr; struct tcf_pedit *p; int ret =3D 0, err; - int ksize; + int i, ksize; u32 index; =20 if (!nla) { @@ -228,6 +228,18 @@ static int tcf_pedit_init(struct net *net, struct nlat= tr *nla, p->tcfp_nkeys =3D parm->nkeys; } memcpy(p->tcfp_keys, parm->keys, ksize); + p->tcfp_off_max_hint =3D 0; + for (i =3D 0; i < p->tcfp_nkeys; ++i) { + u32 cur =3D p->tcfp_keys[i].off; + + /* The AT option can read a single byte, we can bound the actual + * value with uchar max. + */ + cur +=3D (0xff & p->tcfp_keys[i].offmask) >> p->tcfp_keys[i].shift; + + /* Each key touches 4 bytes starting from the computed offset */ + p->tcfp_off_max_hint =3D max(p->tcfp_off_max_hint, cur + 4); + } =20 p->tcfp_flags =3D parm->flags; goto_ch =3D tcf_action_set_ctrlact(*a, parm->action, goto_ch); @@ -308,13 +320,18 @@ static int tcf_pedit_act(struct sk_buff *skb, const s= truct tc_action *a, struct tcf_result *res) { struct tcf_pedit *p =3D to_pedit(a); + u32 max_offset; int i; =20 - if (skb_unclone(skb, GFP_ATOMIC)) - return p->tcf_action; - spin_lock(&p->tcf_lock); =20 + max_offset =3D (skb_transport_header_was_set(skb) ? + skb_transport_offset(skb) : + skb_network_offset(skb)) + + p->tcfp_off_max_hint; + if (skb_ensure_writable(skb, min(skb->len, max_offset))) + return p->tcf_action; + tcf_lastuse_update(&p->tcf_tm); =20 if (p->tcfp_nkeys > 0) { --=20 2.35.1