Patch "net sched actions: fix dumping which requires several messages to user space" has been added to the 4.15-stable tree

This is a note to let you know that I've just added the patch titled

net sched actions: fix dumping which requires several messages to user space

to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-sched-actions-fix-dumping-which-requires-several-messages-to-user-space.patch
and it can be found in the queue-4.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Craig Dillabaugh <[email protected]>
Date: Mon, 26 Mar 2018 14:58:32 -0400
Subject: net sched actions: fix dumping which requires several messages to user space

From: Craig Dillabaugh <[email protected]>

[ Upstream commit 734549eb550c0c720bc89e50501f1b1e98cdd841 ]

Fixes a bug in the tcf_dump_walker function that can cause some actions to not be reported when dumping a large number of actions. This issue became more aggrevated when cookies feature was added. In particular this issue is manifest when large cookie values are assigned to the actions and when enough actions are created that the resulting table must be dumped in multiple batches.

The number of actions returned in each batch is limited by the total number of actions and the memory buffer size. With small cookies the numeric limit is reached before the buffer size limit, which avoids the code path triggering this bug. When large cookies are used buffer fills before the numeric limit, and the erroneous code path is hit.

For example after creating 32 csum actions with the cookie aaaabbbbccccdddd

$ tc actions ls action csum
total acts 26

action order 0: csum (tcp) action continue
index 1 ref 1 bind 0
cookie aaaabbbbccccdddd

.....

action order 25: csum (tcp) action continue
index 26 ref 1 bind 0
cookie aaaabbbbccccdddd
total acts 6

action order 0: csum (tcp) action continue
index 28 ref 1 bind 0
cookie aaaabbbbccccdddd

......

action order 5: csum (tcp) action continue
index 32 ref 1 bind 0
cookie aaaabbbbccccdddd

Note that the action with index 27 is omitted from the report.

---
 net/sched/act_api.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -135,8 +135,10 @@ static int tcf_dump_walker(struct tcf_id
 			continue;
 
 		nest = nla_nest_start(skb, n_i);
-		if (!nest)
+		if (!nest) {
+			index--;
 			goto nla_put_failure;
+		}
 		err = tcf_action_dump_1(skb, p, 0, 0);
 		if (err < 0) {
 			index--;

Patches currently in stable-queue which might be from [email protected] are

queue-4.15/net-sched-actions-fix-dumping-which-requires-several-messages-to-user-space.patch