[v4,net,0/6] net/sched: Fixes for sch_ingress and sch_clsact

Message

Peilin Ye May 23, 2023, 7:12 a.m. UTC

Link to v3 (incomplete): https://lore.kernel.org/r/[e-mail]/
Link to v2: https://lore.kernel.org/r/[e-mail]/
Link to v1: https://lore.kernel.org/r/[e-mail]/

Hi all,

These are v4 fixes for ingress and clsact Qdiscs.

Change since v2:
  - add in-body From: tags

Changes in v2:
  - for [1-5/6], include tags from Jamal and Pedro
  - for [6/6], as suggested by Vlad, replay the request if the current
    Qdisc has any ongoing (RTNL-unlocked) filter requests, instead of
    returning -EBUSY to the user
  - use Closes: tag as warned by checkpatch

[1,2/6]: ingress and clsact Qdiscs should only be created under ffff:fff1
  [3/6]: Under ffff:fff1, only create ingress and clsact Qdiscs (for now,
         at least)
  [4/6]: After creating ingress and clsact Qdiscs under ffff:fff1, do not
         graft them again to anywhere else (e.g. as the inner Qdisc of a
         TBF Qdisc)
  [5/6]: Prepare for [6/6], do not reuse that for-loop in qdisc_graft()
         for ingress and clsact Qdiscs
  [6/6]: Fix use-after-free [a] in mini_qdisc_pair_swap()

[a] https://syzkaller.appspot.com/bug?extid=b53a9c0d1ea4ad62da8b

Thanks,
Peilin Ye (6):
  net/sched: sch_ingress: Only create under TC_H_INGRESS
  net/sched: sch_clsact: Only create under TC_H_CLSACT
  net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact)
    Qdiscs
  net/sched: Prohibit regrafting ingress or clsact Qdiscs
  net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
  net/sched: qdisc_destroy() old ingress and clsact Qdiscs before
    grafting

 include/net/sch_generic.h |  8 ++++++
 net/sched/sch_api.c       | 60 +++++++++++++++++++++++++++++----------
 net/sched/sch_generic.c   | 14 +++++++--
 net/sched/sch_ingress.c   | 10 +++++--
 4 files changed, 72 insertions(+), 20 deletions(-)

Comments

Peilin Ye May 23, 2023, 8:17 p.m. UTC | #1

On Tue, May 23, 2023 at 12:12:39AM -0700, Peilin Ye wrote:
> [1,2/6]: ingress and clsact Qdiscs should only be created under ffff:fff1
>   [3/6]: Under ffff:fff1, only create ingress and clsact Qdiscs (for now,
>          at least)
>   [4/6]: After creating ingress and clsact Qdiscs under ffff:fff1, do not
>          graft them again to anywhere else (e.g. as the inner Qdisc of a
>          TBF Qdisc)
>   [5/6]: Prepare for [6/6], do not reuse that for-loop in qdisc_graft()
>          for ingress and clsact Qdiscs
>   [6/6]: Fix use-after-free [a] in mini_qdisc_pair_swap()

In v5, I'll improve [6/6] according to Vlad's suggestion [a], and fix
[1,2/6] according to Pedro's report [b].

[a] https://lore.kernel.org/r/[e-mail]/
[b] https://lore.kernel.org/r/[e-mail]/

Thanks,
Peilin Ye