lkml.org 
[lkml]   [2021]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 80/86] net_sched: reject silly cell_log in qdisc_get_rtab()
    Date
    From: Eric Dumazet <edumazet@google.com>

    commit e4bedf48aaa5552bc1f49703abd17606e7e6e82a upstream.

    iproute2 probably never goes beyond 8 for the cell exponent,
    but stick to the max shift exponent for signed 32bit.

    UBSAN reported:
    UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22
    shift exponent 130 is too large for 32-bit type 'int'
    CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:79 [inline]
    dump_stack+0x183/0x22e lib/dump_stack.c:120
    ubsan_epilogue lib/ubsan.c:148 [inline]
    __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
    __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389
    qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435
    cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180
    qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246
    tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662
    rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564
    netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494
    netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
    netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330
    netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919
    sock_sendmsg_nosec net/socket.c:652 [inline]
    sock_sendmsg net/socket.c:672 [inline]
    ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345
    ___sys_sendmsg net/socket.c:2399 [inline]
    __sys_sendmsg+0x319/0x400 net/socket.c:2432
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Acked-by: Cong Wang <cong.wang@bytedance.com>
    Link: https://lore.kernel.org/r/20210114160637.1660597-1-eric.dumazet@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/sched/sch_api.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/sched/sch_api.c
    +++ b/net/sched/sch_api.c
    @@ -409,7 +409,8 @@ struct qdisc_rate_table *qdisc_get_rtab(
    {
    struct qdisc_rate_table *rtab;

    - if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
    + if (tab == NULL || r->rate == 0 ||
    + r->cell_log == 0 || r->cell_log >= 32 ||
    nla_len(tab) != TC_RTAB_SIZE) {
    NL_SET_ERR_MSG(extack, "Invalid rate table parameters for searching");
    return NULL;

    \
     
     \ /
      Last update: 2021-01-25 20:03    [W:4.038 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site