Eric Dumazet
3a87571f0f
sch_red: fix off-by-one checks in red_check_params()
This fixes following syzbot report:
UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
red_set_parms include/net/red.h:237 [inline]
choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414
qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247
tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663
rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
sock_sendmsg_nosec net/socket.c:654 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:674
____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
___sys_sendmsg+0xf3/0x170 net/socket.c:2404
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43f039
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488
R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
Fixes: 8afa10cbe2 ("net_sched: red: Avoid illegal values")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-03-25 17:40:43 -07:00
..
2020-11-19 17:21:34 +01:00
2021-02-01 17:04:17 +01:00
2020-09-29 14:02:53 -07:00
2021-01-28 20:36:21 -08:00
2021-03-18 00:32:21 +01:00
2021-02-02 17:45:59 -08:00
2020-12-04 17:47:35 -08:00
2020-11-05 14:27:30 -08:00
2020-10-15 12:43:21 -07:00
2020-02-28 14:51:30 +01:00
2021-02-16 17:51:13 -08:00
2020-08-18 15:58:53 -07:00
2020-08-20 18:21:28 +01:00
2020-02-28 12:12:53 -08:00
2019-12-11 15:01:23 -08:00
2019-11-06 16:14:48 -08:00
2020-07-21 18:30:47 -07:00
2020-05-01 12:15:37 -07:00
2019-07-04 12:30:48 -07:00
2021-01-18 20:48:40 -08:00
2020-11-12 18:39:28 -08:00
2020-12-01 15:51:19 +01:00
2021-02-12 09:33:34 +01:00
2020-02-29 14:39:08 +01:00
2020-08-20 15:45:15 -04:00
2020-07-15 07:45:24 -07:00
2020-03-27 19:40:38 -07:00
2020-11-23 13:31:54 -08:00
2021-02-11 13:04:49 -08:00
2020-02-29 21:52:20 -08:00
2021-02-16 14:47:46 -08:00
2019-12-16 16:09:44 -08:00
2020-05-08 21:33:33 -07:00
2021-03-10 12:24:18 -08:00
2020-05-05 13:23:29 -07:00
2020-02-19 13:52:32 +01:00
2020-04-20 07:34:16 +02:00
2019-12-24 22:37:30 -08:00
2020-07-28 17:42:31 -07:00
2020-07-24 15:23:31 -07:00
2021-01-29 18:05:30 -08:00
2020-11-23 18:36:21 -05:00
2021-01-21 13:33:45 +01:00
2021-01-21 13:33:45 +01:00
2019-12-09 10:36:44 -08:00
2019-11-05 18:20:55 -08:00
2021-02-12 16:31:46 -08:00
2021-01-29 20:39:14 -08:00
2021-02-04 18:37:57 -08:00
2020-06-22 21:12:44 -07:00
2019-10-25 16:24:32 -07:00
2021-02-23 11:29:52 -08:00
2020-11-06 11:01:01 +01:00
2020-05-11 13:18:54 -07:00
2020-03-30 13:45:04 -07:00
2021-01-27 18:18:15 -08:00
2021-03-15 14:34:29 -07:00
2020-12-14 18:38:58 -08:00
2020-12-12 15:08:54 -08:00
2020-11-23 16:32:33 -08:00
2020-08-26 07:33:19 -07:00
2019-09-27 12:05:02 +02:00
2020-06-20 17:47:53 -07:00
2021-02-08 16:47:03 -08:00
2021-01-26 18:39:45 -08:00
2021-02-08 16:47:03 -08:00
2020-11-19 19:08:46 -08:00
2021-02-04 18:37:57 -08:00
2020-11-10 17:56:54 -08:00
2020-11-19 10:49:50 -08:00
2020-08-31 12:26:39 -07:00
2020-11-19 10:49:50 -08:00
2020-02-05 14:28:09 +01:00
2020-06-20 17:22:22 -07:00
2021-01-26 17:53:45 -08:00
2019-10-08 13:23:05 -07:00
2020-03-29 22:30:57 -07:00
2021-01-26 11:55:50 +01:00
2020-03-26 20:17:36 -07:00
2020-03-02 11:16:27 -08:00
2020-02-29 21:52:20 -08:00
2020-02-28 12:08:37 -08:00
2020-05-29 21:20:20 -07:00
2020-12-09 19:02:15 -08:00
2019-12-09 10:36:44 -08:00
2020-08-24 06:40:07 -07:00
2020-11-13 14:24:39 -08:00
2021-02-11 14:10:07 -08:00
2020-11-16 08:08:54 -08:00
2019-11-12 08:18:03 -08:00
2021-03-10 12:35:23 -08:00
2020-11-14 02:29:00 +01:00
2020-03-04 13:25:55 -08:00
2021-01-22 20:41:29 -08:00
2020-11-07 10:41:15 -08:00
2019-09-16 09:18:03 +02:00
2021-03-25 17:40:43 -07:00
2020-07-31 09:24:23 +02:00
2020-08-24 14:35:00 -07:00
2020-11-23 18:36:21 -05:00
2020-06-23 20:27:09 -07:00
2021-03-16 08:40:04 +01:00
2021-02-02 14:21:31 -08:00
2020-07-13 11:03:44 -07:00
2020-06-04 15:39:32 -07:00
2020-09-28 15:19:03 -07:00
2019-10-05 16:29:00 -07:00
2020-02-29 21:52:19 -08:00
2021-03-12 12:27:14 -08:00
2021-02-16 14:47:46 -08:00
2021-02-16 13:14:06 -08:00
2019-10-04 14:07:07 -07:00
2020-11-27 18:25:27 -08:00
2020-06-23 20:10:15 -07:00
2020-06-18 20:46:23 -07:00
2021-02-04 18:37:14 -08:00
2021-02-04 18:37:57 -08:00
2019-11-14 18:12:17 -08:00
2020-09-14 16:49:39 -07:00
2019-12-09 10:28:43 -08:00
2019-11-16 12:39:10 -08:00
2020-11-17 22:07:40 +01:00
2020-12-18 16:10:21 +01:00
2021-02-04 01:00:07 +01:00
2020-10-05 18:40:01 -07:00
2020-12-18 16:10:21 +01:00