Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93f54354 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

fq_codel: reject silly quantum parameters 



[ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ]

syzbot found that forcing a big quantum attribute would crash hosts fast,
essentially using this:

tc qd replace dev eth0 root fq_codel quantum 4294967295

This is because fq_codel_dequeue() would have to loop
~2^31 times in :

	if (flow->deficit <= 0) {
		flow->deficit += q->quantum;
		list_move_tail(&flow->flowchain, &q->old_flows);
		goto begin;
	}

SFQ max quantum is 2^19 (half a megabyte)
Lets adopt a max quantum of one megabyte for FQ_CODEL.

Fixes: 4b549a2e ("fq_codel: Fair Queue Codel AQM")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d448b240

include/uapi/linux/pkt_sched.h

+2 −0
Original line number Diff line number Diff line
@@ -807,6 +807,8 @@ struct tc_codel_xstats { 


/* FQ_CODEL */



#define FQ_CODEL_QUANTUM_MAX (1 << 20)



enum {

	TCA_FQ_CODEL_UNSPEC,

	TCA_FQ_CODEL_TARGET,

net/sched/sch_fq_codel.c

+10 −2
Original line number Diff line number Diff line
@@ -370,6 +370,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, 
{

	struct fq_codel_sched_data *q = qdisc_priv(sch);

	struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];

	u32 quantum = 0;

	int err;



	if (!opt)
@@ -387,6 +388,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, 
		    q->flows_cnt > 65536)

			return -EINVAL;

	}

	if (tb[TCA_FQ_CODEL_QUANTUM]) {

		quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));

		if (quantum > FQ_CODEL_QUANTUM_MAX) {

			NL_SET_ERR_MSG(extack, "Invalid quantum");

			return -EINVAL;

		}

	}

	sch_tree_lock(sch);



	if (tb[TCA_FQ_CODEL_TARGET]) {
@@ -413,8 +421,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, 
	if (tb[TCA_FQ_CODEL_ECN])

		q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);



	if (tb[TCA_FQ_CODEL_QUANTUM])

		q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));

	if (quantum)

		q->quantum = quantum;



	if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])

		q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));