Hangbin Liu e125b1cc67 net_sched: Fix missing res info when create new tc_index filter ... [ Upstream commit 008369dcc5 ] Li Shuang reported the following warn: [ 733.484610] WARNING: CPU: 6 PID: 21123 at net/sched/sch_cbq.c:1418 cbq_destroy_class+0x5d/0x70 [sch_cbq] [ 733.495190] Modules linked in: sch_cbq cls_tcindex sch_dsmark rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat l [ 733.574155] syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm igb ixgbe ahci libahci i2c_algo_bit libata i40e i2c_core dca mdio megaraid_sas dm_mirror dm_region_hash dm_log dm_mod [ 733.592500] CPU: 6 PID: 21123 Comm: tc Not tainted 4.18.0-rc8.latest+ #131 [ 733.600169] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.1.5 04/11/2016 [ 733.608518] RIP: 0010:cbq_destroy_class+0x5d/0x70 [sch_cbq] [ 733.614734] Code: e7 d9 d2 48 8b 7b 48 e8 61 05 da d2 48 8d bb f8 00 00 00 e8 75 ae d5 d2 48 39 eb 74 0a 48 89 df 5b 5d e9 16 6c 94 d2 5b 5d c3 <0f> 0b eb b6 0f 1f 44 00 00 66 2e 0f 1f 84 [ 733.635798] RSP: 0018:ffffbfbb066bb9d8 EFLAGS: 00010202 [ 733.641627] RAX: 0000000000000001 RBX: ffff9cdd17392800 RCX: 000000008010000f [ 733.649588] RDX: ffff9cdd1df547e0 RSI: ffff9cdd17392800 RDI: ffff9cdd0f84c800 [ 733.657547] RBP: ffff9cdd0f84c800 R08: 0000000000000001 R09: 0000000000000000 [ 733.665508] R10: ffff9cdd0f84d000 R11: 0000000000000001 R12: 0000000000000001 [ 733.673469] R13: 0000000000000000 R14: 0000000000000001 R15: ffff9cdd17392200 [ 733.681430] FS: 00007f911890a740(0000) GS:ffff9cdd1f8c0000(0000) knlGS:0000000000000000 [ 733.690456] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 733.696864] CR2: 0000000000b5544c CR3: 0000000859374002 CR4: 00000000001606e0 [ 733.704826] Call Trace: [ 733.707554] cbq_destroy+0xa1/0xd0 [sch_cbq] [ 733.712318] qdisc_destroy+0x62/0x130 [ 733.716401] dsmark_destroy+0x2a/0x70 [sch_dsmark] [ 733.721745] qdisc_destroy+0x62/0x130 [ 733.725829] qdisc_graft+0x3ba/0x470 [ 733.729817] tc_get_qdisc+0x2a6/0x2c0 [ 733.733901] ? cred_has_capability+0x7d/0x130 [ 733.738761] rtnetlink_rcv_msg+0x263/0x2d0 [ 733.743330] ? rtnl_calcit.isra.30+0x110/0x110 [ 733.748287] netlink_rcv_skb+0x4d/0x130 [ 733.752576] netlink_unicast+0x1a3/0x250 [ 733.756949] netlink_sendmsg+0x2ae/0x3a0 [ 733.761324] sock_sendmsg+0x36/0x40 [ 733.765213] ___sys_sendmsg+0x26f/0x2d0 [ 733.769493] ? handle_pte_fault+0x586/0xdf0 [ 733.774158] ? __handle_mm_fault+0x389/0x500 [ 733.778919] ? __sys_sendmsg+0x5e/0xa0 [ 733.783099] __sys_sendmsg+0x5e/0xa0 [ 733.787087] do_syscall_64+0x5b/0x180 [ 733.791171] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 733.796805] RIP: 0033:0x7f9117f23f10 [ 733.800791] Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 [ 733.821873] RSP: 002b:00007ffe96818398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 733.830319] RAX: ffffffffffffffda RBX: 000000005b71244c RCX: 00007f9117f23f10 [ 733.838280] RDX: 0000000000000000 RSI: 00007ffe968183e0 RDI: 0000000000000003 [ 733.846241] RBP: 00007ffe968183e0 R08: 000000000000ffff R09: 0000000000000003 [ 733.854202] R10: 00007ffe96817e20 R11: 0000000000000246 R12: 0000000000000000 [ 733.862161] R13: 0000000000662ee0 R14: 0000000000000000 R15: 0000000000000000 [ 733.870121] ---[ end trace 28edd4aad712ddca ]--- This is because we didn't update f->result.res when create new filter. Then in tcindex_delete() -> tcf_unbind_filter(), we will failed to find out the res and unbind filter, which will trigger the WARN_ON() in cbq_destroy_class(). Fix it by updating f->result.res when create new filter. Fixes: 6e0565697a ("net_sched: fix another crash in cls_tcindex") Reported-by: Li Shuang <shuali@redhat.com> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-08-22 07:46:08 +02:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	9p/trans_virtio: discard zero-length reply	2018-02-22 15:42:30 +01:00
802	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
8021q	net: fix use-after-free in GRO with ESP	2018-07-22 14:28:44 +02:00
appletalk	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atm	atm: Preserve value of skb->truesize when accounting to vcc	2018-07-22 14:28:43 +02:00
ax25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
batman-adv	batman-adv: fix packet loss for broadcasted DHCP packets to a server	2018-05-30 07:52:19 +02:00
bluetooth	Bluetooth: hidp: buffer overflow in hidp_process_report	2018-08-17 21:01:11 +02:00
bpf
bridge	netfilter: ebtables: reject non-bridge targets	2018-07-22 14:28:49 +02:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once	2018-01-23 19:58:17 +01:00
ceph	libceph, ceph: avoid memory leak when specifying same option several times	2018-05-30 07:52:04 +02:00
core	rtnetlink: add rtnl_link_state check in rtnl_configure_link	2018-07-28 07:55:42 +02:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-22 07:46:08 +02:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:07:52 +01:00
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:28:49 +02:00
dsa	net: dsa: Do not suspend/resume closed slave_dev	2018-08-06 16:20:48 +02:00
ethernet
hsr	net/hsr: Check skb_put_padto() return value	2017-08-22 13:40:23 -07:00
ieee802154	ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()	2018-03-31 18:10:40 +02:00
ife	net: sched: ife: check on metadata length	2018-04-29 11:33:13 +02:00
ipv4	ipv4: frags: handle possible skb truesize change	2018-08-06 16:20:47 +02:00
ipv6	multicast: do not restore deleted record source filter mode to new one	2018-07-28 07:55:42 +02:00
ipx	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:10:41 +02:00
kcm	kcm: Fix use-after-free caused by clonned sockets	2018-06-11 22:49:19 +02:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:45:14 +02:00
l2tp	l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache	2018-08-22 07:46:08 +02:00
l3mdev
lapb
llc	llc: use refcount_inc_not_zero() for llc_sap_find()	2018-08-22 07:46:08 +02:00
mac80211	mac80211: use timeout from the AddBA response instead of the request	2018-06-21 04:02:55 +09:00
mac802154	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mpls	mpls, nospec: Sanitize array index in mpls_label_ok()	2018-02-22 15:42:28 +01:00
ncsi	net/ncsi: Fix length of GVI response packet	2017-10-21 01:56:38 +01:00
netfilter	netfilter: nf_tables: check msg_type before nft_trans_set(trans)	2018-08-03 07:50:25 +02:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-05-30 07:52:40 +02:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:16:38 +02:00
netrom
nfc	net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.	2018-07-22 14:28:49 +02:00
nsh	nsh: set mac len based on inner packet	2018-07-22 14:28:49 +02:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-19 10:20:24 +02:00
packet	net/packet: fix use-after-free	2018-07-22 14:28:46 +02:00
phonet	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	qrtr: add MODULE_ALIAS macro to smd	2018-05-30 07:52:05 +02:00
rds	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:28:49 +02:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:10:26 +02:00
rose
rxrpc	rxrpc: Fix user call ID check in rxrpc_service_prealloc_one	2018-08-06 16:20:48 +02:00
sched	net_sched: Fix missing res info when create new tc_index filter	2018-08-22 07:46:08 +02:00
sctp	sctp: not allow transport timeout value less than HZ/5 for hb_timer	2018-06-11 22:49:20 +02:00
smc	smc: fix sendpage() call	2018-06-21 04:02:53 +09:00
strparser	strparser: Remove early eaten to fix full tcp receive buffer stall	2018-07-22 14:28:47 +02:00
sunrpc	xprtrdma: Fix corner cases when handling device removal	2018-07-22 14:28:42 +02:00
switchdev	net: switchdev: Remove bridge bypass support from switchdev	2017-08-07 14:48:48 -07:00
tipc	tipc: eliminate KMSAN uninit-value in strcmp complaint	2018-06-21 04:02:56 +09:00
tls	sock: fix sg page frag coalescing in sk_alloc_sg	2018-07-28 07:55:42 +02:00
unix	License cleanup: add SPDX license identifiers to some files	2017-11-02 10:04:46 -07:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-22 07:46:08 +02:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	cfg80211: clear wep keys after disconnection	2018-05-30 07:51:58 +02:00
x25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm	xfrm: Fix transport mode skb control buffer usage.	2018-05-30 07:52:19 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-05-19 10:20:24 +02:00
Kconfig	net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros.	2017-09-04 13:25:20 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c	net: socket: fix potential spectre v1 gadget in socketcall	2018-08-06 16:20:48 +02:00
sysctl_net.c