Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cdacfbb6 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

sch_sfq: validate silly quantum values 



[ Upstream commit df4953e4e997e273501339f607b77953772e3559 ]

syzbot managed to set up sfq so that q->scaled_quantum was zero,
triggering an infinite loop in sfq_dequeue()

More generally, we must only accept quantum between 1 and 2^18 - 7,
meaning scaled_quantum must be in [1, 0x7FFF] range.

Otherwise, we also could have a loop in sfq_dequeue()
if scaled_quantum happens to be 0x8000, since slot->allot
could indefinitely switch between 0 and 0x8000.

Fixes: eeaeb068 ("sch_sfq: allow big packets and be fair")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatar <syzbot+0251e883fe39e7a0cb0a@syzkaller.appspotmail.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9a67503a

net/sched/sch_sfq.c

+9 −0
Original line number Diff line number Diff line
@@ -641,6 +641,15 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) 
	if (ctl->divisor &&

	    (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))

		return -EINVAL;



	/* slot->allot is a short, make sure quantum is not too big. */

	if (ctl->quantum) {

		unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum);



		if (scaled <= 0 || scaled > SHRT_MAX)

			return -EINVAL;

	}



	if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,

					ctl_v1->Wlog))

		return -EINVAL;