Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9850f930 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

sch_netem: fix a divide by zero in tabledist() 



[ Upstream commit b41d936b5ecfdb3a4abc525ce6402a6c49cffddc ]

syzbot managed to crash the kernel in tabledist() loading
an empty distribution table.

	t = dist->table[rnd % dist->size];

Simply return an error when such load is attempted.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ac7ac130

net/sched/sch_netem.c

+1 −1
Original line number Diff line number Diff line
@@ -711,7 +711,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr) 
	int i;

	size_t s;



	if (n > NETEM_DIST_MAX)

	if (!n || n > NETEM_DIST_MAX)

		return -EINVAL;



	s = sizeof(struct disttable) + n * sizeof(s16);