lkml.org 
[lkml]   [2022]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 542/545] net_sched: cls_route: disallow handle of 0
    Date
    From: Jamal Hadi Salim <jhs@mojatatu.com>

    commit 02799571714dc5dd6948824b9d080b44a295f695 upstream.

    Follows up on:
    https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/

    handle of 0 implies from/to of universe realm which is not very
    sensible.

    Lets see what this patch will do:
    $sudo tc qdisc add dev $DEV root handle 1:0 prio

    //lets manufacture a way to insert handle of 0
    $sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \
    route to 0 from 0 classid 1:10 action ok

    //gets rejected...
    Error: handle of 0 is not valid.
    We have an error talking to the kernel, -1

    //lets create a legit entry..
    sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \
    classid 1:10 action ok

    //what did the kernel insert?
    $sudo tc filter ls dev $DEV parent 1:0
    filter protocol ip pref 100 route chain 0
    filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10
    action order 1: gact action pass
    random type none pass val 0
    index 1 ref 1 bind 1

    //Lets try to replace that legit entry with a handle of 0
    $ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \
    handle 0x000a8000 route to 0 from 0 classid 1:10 action drop

    Error: Replacing with handle of 0 is invalid.
    We have an error talking to the kernel, -1

    And last, lets run Cascardo's POC:
    $ ./poc
    0
    0
    -22
    -22
    -22

    Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Acked-by: Stephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sched/cls_route.c | 10 ++++++++++
    1 file changed, 10 insertions(+)

    --- a/net/sched/cls_route.c
    +++ b/net/sched/cls_route.c
    @@ -424,6 +424,11 @@ static int route4_set_parms(struct net *
    return -EINVAL;
    }

    + if (!nhandle) {
    + NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid");
    + return -EINVAL;
    + }
    +
    h1 = to_hash(nhandle);
    b = rtnl_dereference(head->table[h1]);
    if (!b) {
    @@ -477,6 +482,11 @@ static int route4_change(struct net *net
    int err;
    bool new = true;

    + if (!handle) {
    + NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid");
    + return -EINVAL;
    + }
    +
    if (opt == NULL)
    return handle ? -EINVAL : 0;


    \
     
     \ /
      Last update: 2022-08-19 18:55    [W:4.090 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site