| Message ID | 20210416233046.12399-1-ducheng2@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v4] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule | expand |
On Fri, Apr 16, 2021 at 4:30 PM Du Cheng <ducheng2@gmail.com> wrote: > > There is a reproducible sequence from the userland that will trigger a WARN_ON() > condition in taprio_get_start_time, which causes kernel to panic if configured > as "panic_on_warn". Catch this condition in parse_taprio_schedule to > prevent this condition. > > Reported as bug on syzkaller: > https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c > > Reported-by: syzbot+d50710fd0873a9c6b40c@syzkaller.appspotmail.com > Signed-off-by: Du Cheng <ducheng2@gmail.com> Acked-by: Cong Wang <cong.wang@bytedance.com> Thanks.
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Sat, 17 Apr 2021 07:30:46 +0800 you wrote: > There is a reproducible sequence from the userland that will trigger a WARN_ON() > condition in taprio_get_start_time, which causes kernel to panic if configured > as "panic_on_warn". Catch this condition in parse_taprio_schedule to > prevent this condition. > > Reported as bug on syzkaller: > https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c > > [...] Here is the summary with links: - [v4] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule https://git.kernel.org/netdev/net/c/ed8157f1ebf1 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 8287894541e3..909c798b7403 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -901,6 +901,12 @@ static int parse_taprio_schedule(struct taprio_sched *q, struct nlattr **tb, list_for_each_entry(entry, &new->entries, list) cycle = ktime_add_ns(cycle, entry->interval); + + if (!cycle) { + NL_SET_ERR_MSG(extack, "'cycle_time' can never be 0"); + return -EINVAL; + } + new->cycle_time = cycle; }
There is a reproducible sequence from the userland that will trigger a WARN_ON() condition in taprio_get_start_time, which causes kernel to panic if configured as "panic_on_warn". Catch this condition in parse_taprio_schedule to prevent this condition. Reported as bug on syzkaller: https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c Reported-by: syzbot+d50710fd0873a9c6b40c@syzkaller.appspotmail.com Signed-off-by: Du Cheng <ducheng2@gmail.com> --- changelog v1: Discussion https://lore.kernel.org/netdev/YHfwUmFODUHx8G5W@carbon/T/ v2: fix typo https://lore.kernel.org/netdev/20210415075953.83508-2-ducheng2@gmail.com/T/ v3: catch the condition in parse_taprio_schedule instead https://lore.kernel.org/netdev/CAM_iQpWs3Z55=y0-=PJT6xZMv+Hw9JGPLFXmbr+35+70DAYsOQ@mail.gmail.com/T/ v4: add extack net/sched/sch_taprio.c | 6 ++++++ 1 file changed, 6 insertions(+)