From nobody Thu Dec 18 09:46:16 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 818ECC001DB for ; Sun, 13 Aug 2023 20:08:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231633AbjHMUIp (ORCPT ); Sun, 13 Aug 2023 16:08:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229627AbjHMUIo (ORCPT ); Sun, 13 Aug 2023 16:08:44 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72F5710F6; Sun, 13 Aug 2023 13:08:46 -0700 (PDT) Received: from fpc.intra.ispras.ru (unknown [10.10.165.4]) by mail.ispras.ru (Postfix) with ESMTPSA id CC3B040F1DD0; Sun, 13 Aug 2023 20:08:44 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru CC3B040F1DD0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1691957324; bh=uBrIycA7GxZzIxx3cAjN+Sc/QEGkH5VDq6EcRqs1Mww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g8Z3CciSykT9eSkHyT2nPWwaTCKrAVVrYecRkLRS4Nur8LfAwk2Y+imgmKku0etXW ZrHpb6c2cyAH7d9AedvzUmrygWNy4AuxT8RT2HThF7ruW8qyPKAL4rjCuJKhQ8V4KT HX5AJCA/U7Pg9fO+9lsJjHN56efBR3PwU2UL/XH0= From: Fedor Pchelkin To: Greg Kroah-Hartman , stable@vger.kernel.org Cc: Fedor Pchelkin , Jamal Hadi Salim , Eric Dumazet , Jakub Kicinski , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, Stephen Hemminger , syzbot Subject: [PATCH 4.19/5.4/5.10/5.15/6.1 1/1] sch_netem: fix issues in netem_change() vs get_dist_table() Date: Sun, 13 Aug 2023 23:07:46 +0300 Message-Id: <20230813200746.288589-2-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230813200746.288589-1-pchelkin@ispras.ru> References: <20230813200746.288589-1-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 11b73313c12403f617b47752db0ab3deef201af7 upstream. In blamed commit, I missed that get_dist_table() was allocating memory using GFP_KERNEL, and acquiring qdisc lock to perform the swap of newly allocated table with current one. In this patch, get_dist_table() is allocating memory and copy user data before we acquire the qdisc lock. Then we perform swap operations while being protected by the lock. Note that after this patch netem_change() no longer can do partial changes. If an error is returned, qdisc conf is left unchanged. Fixes: 2174a08db80d ("sch_netem: acquire qdisc lock in netem_change()") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Stephen Hemminger Acked-by: Jamal Hadi Salim Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230622181503.2327695-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Fedor Pchelkin --- net/sched/sch_netem.c | 59 ++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 34 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index e79be1b3e74d..b93ec2a3454e 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -773,12 +773,10 @@ static void dist_free(struct disttable *d) * signed 16 bit values. */ =20 -static int get_dist_table(struct Qdisc *sch, struct disttable **tbl, - const struct nlattr *attr) +static int get_dist_table(struct disttable **tbl, const struct nlattr *att= r) { size_t n =3D nla_len(attr)/sizeof(__s16); const __s16 *data =3D nla_data(attr); - spinlock_t *root_lock; struct disttable *d; int i; =20 @@ -793,13 +791,7 @@ static int get_dist_table(struct Qdisc *sch, struct di= sttable **tbl, for (i =3D 0; i < n; i++) d->table[i] =3D data[i]; =20 - root_lock =3D qdisc_root_sleeping_lock(sch); - - spin_lock_bh(root_lock); - swap(*tbl, d); - spin_unlock_bh(root_lock); - - dist_free(d); + *tbl =3D d; return 0; } =20 @@ -956,6 +948,8 @@ static int netem_change(struct Qdisc *sch, struct nlatt= r *opt, { struct netem_sched_data *q =3D qdisc_priv(sch); struct nlattr *tb[TCA_NETEM_MAX + 1]; + struct disttable *delay_dist =3D NULL; + struct disttable *slot_dist =3D NULL; struct tc_netem_qopt *qopt; struct clgstate old_clg; int old_loss_model =3D CLG_RANDOM; @@ -966,6 +960,18 @@ static int netem_change(struct Qdisc *sch, struct nlat= tr *opt, if (ret < 0) return ret; =20 + if (tb[TCA_NETEM_DELAY_DIST]) { + ret =3D get_dist_table(&delay_dist, tb[TCA_NETEM_DELAY_DIST]); + if (ret) + goto table_free; + } + + if (tb[TCA_NETEM_SLOT_DIST]) { + ret =3D get_dist_table(&slot_dist, tb[TCA_NETEM_SLOT_DIST]); + if (ret) + goto table_free; + } + sch_tree_lock(sch); /* backup q->clg and q->loss_model */ old_clg =3D q->clg; @@ -975,26 +981,17 @@ static int netem_change(struct Qdisc *sch, struct nla= ttr *opt, ret =3D get_loss_clg(q, tb[TCA_NETEM_LOSS]); if (ret) { q->loss_model =3D old_loss_model; + q->clg =3D old_clg; goto unlock; } } else { q->loss_model =3D CLG_RANDOM; } =20 - if (tb[TCA_NETEM_DELAY_DIST]) { - ret =3D get_dist_table(sch, &q->delay_dist, - tb[TCA_NETEM_DELAY_DIST]); - if (ret) - goto get_table_failure; - } - - if (tb[TCA_NETEM_SLOT_DIST]) { - ret =3D get_dist_table(sch, &q->slot_dist, - tb[TCA_NETEM_SLOT_DIST]); - if (ret) - goto get_table_failure; - } - + if (delay_dist) + swap(q->delay_dist, delay_dist); + if (slot_dist) + swap(q->slot_dist, slot_dist); sch->limit =3D qopt->limit; =20 q->latency =3D PSCHED_TICKS2NS(qopt->latency); @@ -1044,17 +1041,11 @@ static int netem_change(struct Qdisc *sch, struct n= lattr *opt, =20 unlock: sch_tree_unlock(sch); - return ret; =20 -get_table_failure: - /* recover clg and loss_model, in case of - * q->clg and q->loss_model were modified - * in get_loss_clg() - */ - q->clg =3D old_clg; - q->loss_model =3D old_loss_model; - - goto unlock; +table_free: + dist_free(delay_dist); + dist_free(slot_dist); + return ret; } =20 static int netem_init(struct Qdisc *sch, struct nlattr *opt, --=20 2.34.1