lkml.org 
[lkml]   [2020]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 11/48] sch_sfq: validate silly quantum values
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit df4953e4e997e273501339f607b77953772e3559 ]

    syzbot managed to set up sfq so that q->scaled_quantum was zero,
    triggering an infinite loop in sfq_dequeue()

    More generally, we must only accept quantum between 1 and 2^18 - 7,
    meaning scaled_quantum must be in [1, 0x7FFF] range.

    Otherwise, we also could have a loop in sfq_dequeue()
    if scaled_quantum happens to be 0x8000, since slot->allot
    could indefinitely switch between 0 and 0x8000.

    Fixes: eeaeb068f139 ("sch_sfq: allow big packets and be fair")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot+0251e883fe39e7a0cb0a@syzkaller.appspotmail.com
    Cc: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sched/sch_sfq.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    --- a/net/sched/sch_sfq.c
    +++ b/net/sched/sch_sfq.c
    @@ -641,6 +641,15 @@ static int sfq_change(struct Qdisc *sch,
    if (ctl->divisor &&
    (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
    return -EINVAL;
    +
    + /* slot->allot is a short, make sure quantum is not too big. */
    + if (ctl->quantum) {
    + unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum);
    +
    + if (scaled <= 0 || scaled > SHRT_MAX)
    + return -EINVAL;
    + }
    +
    if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
    ctl_v1->Wlog))
    return -EINVAL;

    \
     
     \ /
      Last update: 2020-05-13 12:06    [W:4.160 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site