Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 14:47 -0800, Cong Wang wrote: > On Tue, Dec 1, 2015 at 2:33 PM, Eric Dumazet wrote: > > Hmm... it looks like we have a much more serious bug : > > > > qdisc_lookup() calls qdisc_match_from_root(dev->qdisc, handle) without > > proper lock being held, so we might actually crash

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Cong Wang
On Tue, Dec 1, 2015 at 2:33 PM, Eric Dumazet wrote: > Hmm... it looks like we have a much more serious bug : > > qdisc_lookup() calls qdisc_match_from_root(dev->qdisc, handle) without > proper lock being held, so we might actually crash the host, > if qdisc_tree_decrease_qlen() happens at the time

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Cong Wang
On Tue, Dec 1, 2015 at 12:06 PM, Eric Dumazet wrote: > On Tue, 2015-12-01 at 11:17 -0800, Cong Wang wrote: >> On Tue, Dec 1, 2015 at 11:09 AM, Eric Dumazet wrote: >> > On Tue, 2015-12-01 at 10:43 -0800, Cong Wang wrote: >> > >> >> This smells hacky... Another way to fix this is to hold the qdisc

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 12:06 -0800, Eric Dumazet wrote: > On Tue, 2015-12-01 at 11:17 -0800, Cong Wang wrote: > > On Tue, Dec 1, 2015 at 11:09 AM, Eric Dumazet > > wrote: > > > On Tue, 2015-12-01 at 10:43 -0800, Cong Wang wrote: > > > > > >> This smells hacky... Another way to fix this is to hold

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 11:17 -0800, Cong Wang wrote: > On Tue, Dec 1, 2015 at 11:09 AM, Eric Dumazet wrote: > > On Tue, 2015-12-01 at 10:43 -0800, Cong Wang wrote: > > > >> This smells hacky... Another way to fix this is to hold the qdisc tree > >> lock in mq_dump(), since it is not a hot path (com

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Cong Wang
On Tue, Dec 1, 2015 at 11:09 AM, Eric Dumazet wrote: > On Tue, 2015-12-01 at 10:43 -0800, Cong Wang wrote: > >> This smells hacky... Another way to fix this is to hold the qdisc tree >> lock in mq_dump(), since it is not a hot path (comparing with >> enqueue/dequeue)? > > Really ? Which qdisc tree

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Daniele Fucini
I can't be 100% sure but after running transmission for over an hour without any problems I'd say this fix worked. I'll keep it running for a while so if it suddently freezes again I'll report it, but I hope it won't be the case. Daniele On Tue, Dec 01, 2015 at 06:15:37AM -0800, Eric Dumazet wrot

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 10:43 -0800, Cong Wang wrote: > This smells hacky... Another way to fix this is to hold the qdisc tree > lock in mq_dump(), since it is not a hot path (comparing with > enqueue/dequeue)? Really ? Which qdisc tree lock will protect you exactly ??? Whole point of MQ is that e

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Cong Wang
On Tue, Dec 1, 2015 at 8:34 AM, Eric Dumazet wrote: > On Tue, 2015-12-01 at 17:13 +0100, PaX Team wrote: >> On 1 Dec 2015 at 6:10, Eric Dumazet wrote: >> >> > On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: >> > > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: >> > > > Thanks for

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 17:13 +0100, PaX Team wrote: > On 1 Dec 2015 at 6:10, Eric Dumazet wrote: > > > On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: > > > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: > > > > Thanks for the reply. Here's the output of `tc qdisc show`: > > > > ht

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread PaX Team
On 1 Dec 2015 at 6:10, Eric Dumazet wrote: > On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: > > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: > > > Thanks for the reply. Here's the output of `tc qdisc show`: > > > https://gist.github.com/1847102c8fe08f63e9e7 > > > Hmm... I do n

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
> > On Mon, Nov 30, 2015 at 08:50:29PM -0800, Cong Wang wrote: > > > On Mon, Nov 30, 2015 at 5:00 PM, Daniele Fucini wrote: > > > > Hello, > > > > > > > > I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and > > > &

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: > > Thanks for the reply. Here's the output of `tc qdisc show`: > > https://gist.github.com/1847102c8fe08f63e9e7 > Hmm... I do not think we ever took care of MQ in > qdisc_tree_decreas

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Eric Dumazet
2015 at 5:00 PM, Daniele Fucini wrote: > > > Hello, > > > > > > I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and > > > I'm getting system freezes due to PaX detecting a size overflow in > > > function qdisc_tree_de

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-12-01 Thread Daniele Fucini
ecurity patched kernel (version 4.2.6-201511282239) and > > I'm getting system freezes due to PaX detecting a size overflow in > > function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 whenever I use > > Transmission BitTorrent client. > > > > On t

Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-11-30 Thread Cong Wang
On Mon, Nov 30, 2015 at 5:00 PM, Daniele Fucini wrote: > Hello, > > I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and > I'm getting system freezes due to PaX detecting a size overflow in > function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 when

size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c

2015-11-30 Thread Daniele Fucini
Hello, I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and I'm getting system freezes due to PaX detecting a size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 whenever I use Transmission BitTorrent client. On the Grsecurity forum I was