kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Jamal Hadi Salim c811c98718 net_sched: cls_route: disallow handle of 0 
commit 0279957171 upstream.

Follows up on:
https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/

handle of 0 implies from/to of universe realm which is not very
sensible.

Lets see what this patch will do:
$sudo tc qdisc add dev $DEV root handle 1:0 prio

//lets manufacture a way to insert handle of 0
$sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \
route to 0 from 0 classid 1:10 action ok

//gets rejected...
Error: handle of 0 is not valid.
We have an error talking to the kernel, -1

//lets create a legit entry..
sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \
classid 1:10 action ok

//what did the kernel insert?
$sudo tc filter ls dev $DEV parent 1:0
filter protocol ip pref 100 route chain 0
filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10
	action order 1: gact action pass
	 random type none pass val 0
	 index 1 ref 1 bind 1

//Lets try to replace that legit entry with a handle of 0
$ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \
handle 0x000a8000 route to 0 from 0 classid 1:10 action drop

Error: Replacing with handle of 0 is invalid.
We have an error talking to the kernel, -1

And last, lets run Cascardo's POC:
$ ./poc
0
0
-22
-22
-22

Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2022-08-21 15:20:08 +02:00
..
6lowpan net: don't include ndisc.h from ipv6.h 2022-02-04 14:15:11 -08:00
9p net/9p: Initialize the iounit field during fid creation 2022-08-17 15:16:09 +02:00
802 net: 802: Use memset_startat() to clear struct fields 2021-11-19 11:23:23 +00:00
8021q vlan: fix memory leak in vlan_newlink() 2022-07-09 12:26:59 +01:00
appletalk net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
atm net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ax25 ax25: fix incorrect dev_tracker usage 2022-08-17 15:14:57 +02:00
batman-adv batman-adv: tracing: Use the new __vstring() helper 2022-08-17 15:16:15 +02:00
bluetooth Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression 2022-08-17 15:16:21 +02:00
bpf Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-05-23 16:07:14 -07:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge bridge: Do not send empty IFLA_AF_SPEC attribute 2022-07-26 15:35:53 +02:00
caif caif: Fix bitmap data type in "struct caifsock" 2022-07-22 12:51:45 +01:00
can can: bcm: use call_rcu() instead of costly synchronize_rcu() 2022-07-04 10:33:39 +02:00
ceph libceph: use swap() macro instead of taking tmp variable 2022-05-25 20:45:13 +02:00
core bpf: Fix bpf_xdp_pointer return pointer 2022-08-17 15:14:55 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-03 08:01:55 -08:00
dccp dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock 2022-08-17 15:14:59 +02:00
decnet net: Fix data-races around sysctl_[rw]mem(_offset)?. 2022-07-25 12:42:09 +01:00
dns_resolver net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
dsa net: dsa: fix reference counting for LAG FDBs 2022-07-25 19:37:06 -07:00
ethernet net: ethernet: set default assignment identifier to NET_NAME_ENUM 2022-04-07 21:04:03 -07:00
ethtool ethtool: Fix get module eeprom fallback 2022-06-17 20:22:16 -07:00
hsr net: add per-cpu storage and net->core_stats 2022-03-11 23:17:24 -08:00
ieee802154 net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ife net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
ipv4 raw: fix a typo in raw_icmp_error() 2022-08-17 15:16:19 +02:00
ipv6 raw: remove unused variables from raw6_icmp_error() 2022-08-17 15:16:19 +02:00
iucv net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
kcm net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
key Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-06-01 17:44:04 -07:00
l2tp ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-08 10:56:43 -07:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: only change llc->dev when bind() succeeds 2022-03-25 16:55:41 -07:00
mac80211 wifi: mac80211: move some future per-link data to bss_conf 2022-08-17 15:14:46 +02:00
mac802154 net: mac802154: Fix symbol durations 2022-04-30 20:29:47 +02:00
mctp Networking changes for 5.19. 2022-05-25 12:22:58 -07:00
mpls net: mpls: fix memdup.cocci warning 2022-04-07 21:06:41 -07:00
mptcp mptcp: refine memory scheduling 2022-08-17 15:16:19 +02:00
ncsi net/ncsi: use proper "mellanox" DT vendor prefix 2022-06-23 20:51:06 -07:00
netfilter netfilter: nf_tables: fix null deref due to zeroed list head 2022-08-17 15:13:59 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-03-21 10:59:11 +00:00
netlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-12 16:15:30 -07:00
netrom net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
nfc net: nfc: Directly use ida_alloc()/free() 2022-05-28 15:28:47 +01:00
nsh treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
openvswitch net: openvswitch: fix parsing of nw_proto for IPv6 fragments 2022-06-23 11:44:01 +02:00
packet net/af_packet: make sure to pull mac header 2022-06-02 10:15:05 -07:00
phonet net: remove noblock parameter from recvmsg() entities 2022-04-12 15:00:25 +02:00
psample psample: Add additional metadata attributes 2021-03-14 15:00:43 -07:00
qrtr net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
rds Linux 5.18 2022-05-24 12:40:28 -03:00
rfkill rfkill: make new event layout opt-in 2022-03-18 13:09:17 +02:00
rose net: rose: fix netdev reference changes 2022-08-17 15:14:59 +02:00
rxrpc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-23 21:19:17 -07:00
sched net_sched: cls_route: disallow handle of 0 2022-08-21 15:20:08 +02:00
sctp sctp: leave the err path free in sctp_stream_init to sctp_stream_free 2022-07-27 18:23:22 -07:00
smc tcp: Fix data-races around keepalive sysctl knobs. 2022-07-18 12:21:54 +01:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-09 01:05:28 +01:00
sunrpc Notable regression fixes: 2022-07-02 11:20:56 -07:00
switchdev net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device 2022-02-24 21:31:43 -08:00
tipc net: Fix data-races around sysctl_[rw]mem(_offset)?. 2022-07-25 12:42:09 +01:00
tls net/tls: Remove the context from the list in tls_device_down 2022-07-24 21:40:56 +01:00
unix af_unix: Fix a data-race in unix_dgram_peer_wake_me(). 2022-06-07 12:07:46 +02:00
vmw_vsock hyperv-next for 5.19 2022-05-28 11:39:01 -07:00
wireless wifi: cfg80211: remove chandef check in cfg80211_cac_event() 2022-08-17 15:16:20 +02:00
x25 x25: remove redundant pointer dev 2022-05-10 11:59:22 +02:00
xdp xsk: Clear page contiguity bit when unmapping pool 2022-06-28 22:49:04 +02:00
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-07-20 10:11:58 +01:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig page_pool: Add allocation stats 2022-03-03 09:55:28 +00:00
Kconfig.debug net: CONFIG_DEBUG_NET depends on CONFIG_NET 2022-06-02 10:15:05 -07:00
Makefile mctp: Add MCTP base 2021-07-29 15:06:49 +01:00
socket.c net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user() 2022-06-23 20:56:23 -07:00
sysctl_net.c sections: move and rename core_kernel_data() to is_kernel_core_data() 2021-11-09 10:02:50 -08:00