Patch "net/sched: cls_matchall: fix crash when used with classful qdisc" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

net/sched: cls_matchall: fix crash when used with classful qdisc

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-sched-cls_matchall-fix-crash-when-used-with-classful-qdisc.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Davide Caratti <[email protected]>
Date: Sat, 16 Sep 2017 14:02:21 +0200
Subject: net/sched: cls_matchall: fix crash when used with classful qdisc

From: Davide Caratti <[email protected]>

[ Upstream commit 3ff4cbec87da48b0ec1f7b6196607b034de0c680 ]

this script, edited from Linux Advanced Routing and Traffic Control guide

tc q a dev en0 root handle 1: htb default a
tc c a dev en0 parent 1: classid 1:1 htb rate 6mbit burst 15k tc c a dev en0 parent 1:1 classid 1:a htb rate 5mbit ceil 6mbit burst 15k tc c a dev en0 parent 1:1 classid 1:b htb rate 1mbit ceil 6mbit burst 15k tc f a dev en0 parent 1:0 prio 1 $clsname $clsargs classid 1:b ping $address -c1
tc -s c s dev en0

classifies traffic to 1:b or 1:a, depending on whether the packet matches or not the pattern $clsargs of filter $clsname. However, when $clsname is 'matchall', a systematic crash can be observed in htb_classify(). HTB and classful qdiscs don't assign initial value to struct tcf_result, but then they expect it to contain valid values after filters have been run. Thus, current 'matchall' ignores the TCA_MATCHALL_CLASSID attribute, configured by user, and makes HTB (and classful qdiscs) dereference random pointers.

By assigning head->res to *res in mall_classify(), before the actions are invoked, we fix this crash and enable TCA_MATCHALL_CLASSID functionality, that had no effect on 'matchall' classifier since its first introduction.

---
 net/sched/cls_matchall.c |    1 +
 1 file changed, 1 insertion(+)

@@ -32,6 +32,7 @@ static int mall_classify(struct sk_buff
 	if (tc_skip_sw(head->flags))
 		return -1;
 
+	*res = head->res;
 	return tcf_exts_exec(skb, &head->exts, res);
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/net-sched-cls_matchall-fix-crash-when-used-with-classful-qdisc.patch