Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Pablo Neira Ayuso 607774a137 netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext ... [ Upstream commit 542ed8145e ] Access to genmask field in struct nft_set_ext results in unaligned atomic read: [ 72.130109] Unable to handle kernel paging request at virtual address ffff0000c2bb708c [ 72.131036] Mem abort info: [ 72.131213] ESR = 0x0000000096000021 [ 72.131446] EC = 0x25: DABT (current EL), IL = 32 bits [ 72.132209] SET = 0, FnV = 0 [ 72.133216] EA = 0, S1PTW = 0 [ 72.134080] FSC = 0x21: alignment fault [ 72.135593] Data abort info: [ 72.137194] ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 [ 72.142351] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 72.145989] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 72.150115] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000237d27000 [ 72.154893] [ffff0000c2bb708c] pgd=0000000000000000, p4d=180000023ffff403, pud=180000023f84b403, pmd=180000023f835403, +pte=0068000102bb7707 [ 72.163021] Internal error: Oops: 0000000096000021 [#1] SMP [...] [ 72.170041] CPU: 7 UID: 0 PID: 54 Comm: kworker/7:0 Tainted: G E 6.13.0-rc3+ #2 [ 72.170509] Tainted: [E]=UNSIGNED_MODULE [ 72.170720] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-stable202302-for-qemu 03/01/2023 [ 72.171192] Workqueue: events_power_efficient nft_rhash_gc [nf_tables] [ 72.171552] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 72.171915] pc : nft_rhash_gc+0x200/0x2d8 [nf_tables] [ 72.172166] lr : nft_rhash_gc+0x128/0x2d8 [nf_tables] [ 72.172546] sp : ffff800081f2bce0 [ 72.172724] x29: ffff800081f2bd40 x28: ffff0000c2bb708c x27: 0000000000000038 [ 72.173078] x26: ffff0000c6780ef0 x25: ffff0000c643df00 x24: ffff0000c6778f78 [ 72.173431] x23: 000000000000001a x22: ffff0000c4b1f000 x21: ffff0000c6780f78 [ 72.173782] x20: ffff0000c2bb70dc x19: ffff0000c2bb7080 x18: 0000000000000000 [ 72.174135] x17: ffff0000c0a4e1c0 x16: 0000000000003000 x15: 0000ac26d173b978 [ 72.174485] x14: ffffffffffffffff x13: 0000000000000030 x12: ffff0000c6780ef0 [ 72.174841] x11: 0000000000000000 x10: ffff800081f2bcf8 x9 : ffff0000c3000000 [ 72.175193] x8 : 00000000000004be x7 : 0000000000000000 x6 : 0000000000000000 [ 72.175544] x5 : 0000000000000040 x4 : ffff0000c3000010 x3 : 0000000000000000 [ 72.175871] x2 : 0000000000003a98 x1 : ffff0000c2bb708c x0 : 0000000000000004 [ 72.176207] Call trace: [ 72.176316] nft_rhash_gc+0x200/0x2d8 [nf_tables] (P) [ 72.176653] process_one_work+0x178/0x3d0 [ 72.176831] worker_thread+0x200/0x3f0 [ 72.176995] kthread+0xe8/0xf8 [ 72.177130] ret_from_fork+0x10/0x20 [ 72.177289] Code: 54fff984 d503201f d2800080 91003261 (f820303f) [ 72.177557] ---[ end trace 0000000000000000 ]--- Align struct nft_set_ext to word size to address this and documentation it. pahole reports that this increases the size of elements for rhash and pipapo in 8 bytes on x86_64. Fixes: 7ffc748115 ("netfilter: nft_set_hash: skip duplicated elements pending gc run") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2025-01-09 13:30:01 +01:00
..
acpi	ACPI: CPPC: Make rmw_lock a raw_spin_lock	2024-11-08 16:26:43 +01:00
asm-generic	vmlinux.lds.h: catch .bss..L* sections into BSS")	2024-08-03 08:49:02 +02:00
clocksource	x86/hyperv: Fix hv tsc page based sched_clock for hibernation	2025-01-09 13:29:56 +01:00
crypto	crypto: simd - Do not call crypto_alloc_tfm during registration	2024-10-17 15:21:39 +02:00
drm	drm/ttm: Make sure the mapped tt pages are decrypted when needed	2024-12-14 19:54:54 +01:00
dt-bindings	dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x	2024-10-17 15:22:07 +02:00
keys	certs: Move load_certificate_list() to be with the asymmetric keys code	2022-06-21 16:05:06 +01:00
kunit	kunit: add macro to allow conditionally exposing static symbols to tests	2023-11-20 11:52:08 +01:00
kvm	KVM: arm64: Fix host-programmed guest events in nVHE	2024-04-10 16:28:23 +02:00
linux	RDMA/mlx5: Enforce same type port association for multiport RoCE	2025-01-09 13:29:57 +01:00
math-emu	powerpc/math-emu: Remove -w build flag and fix warnings	2022-09-05 17:28:25 +10:00
media	media: v4l2-core: v4l2-dv-timings: check cvt/gtf result	2024-12-14 19:54:04 +01:00
memory	memory: renesas-rpc-if: Remove Runtime PM wrappers	2024-12-14 19:53:37 +01:00
misc	ocxl: Update the Process Element Entry	2020-12-04 01:01:30 +11:00
net	netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext	2025-01-09 13:30:01 +01:00
pcmcia	ARM: pxa/sa1100: move I/O space to PCI_IOBASE	2022-05-07 22:56:17 +02:00
ras	mm, hwpoison: enable memory error handling on 1GB hugepage	2022-08-08 18:06:44 -07:00
rdma	RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz	2023-12-13 18:39:15 +01:00
rv	Documentation/rv: Add deterministic automata monitor synthesis documentation	2022-07-30 14:01:29 -04:00
scsi	scsi: core: Fix the return value of scsi_logical_block_count()	2024-08-29 17:30:49 +02:00
soc	net: mscc: ocelot: be resilient to loss of PTP packets during transmission	2024-12-19 18:08:54 +01:00
sound	ALSA: dmaengine: Synchronize dma channel after drop()	2024-07-25 09:49:14 +02:00
target	scsi: target: Fix multiple LUN_RESET handling	2023-05-11 23:03:19 +09:00
trace	tracing/ftrace: disable preemption in syscall probe	2024-12-14 19:54:45 +01:00
uapi	stddef: make __struct_group() UAPI C++-friendly	2025-01-02 10:30:51 +01:00
ufs	scsi: ufs: core: Make DMA mask configuration more flexible	2024-12-14 19:54:46 +01:00
vdso	time64.h: Consolidated PSEC_PER_SEC definition	2021-04-06 16:32:17 -07:00
video	video: Provide constants for VGA I/O range	2022-07-19 13:19:11 +02:00
xen	xen: simplify evtchn_do_upcall() call maze	2023-12-08 08:51:20 +01:00