diff mbox series

[net] net_sched: reject silly cell_log in qdisc_get_rtab()

Message ID 20210114160637.1660597-1-eric.dumazet@gmail.com
State New
Headers show
Series [net] net_sched: reject silly cell_log in qdisc_get_rtab() | expand

Commit Message

Eric Dumazet Jan. 14, 2021, 4:06 p.m. UTC
From: Eric Dumazet <edumazet@google.com>

iproute2 probably never goes beyond 8 for the cell exponent,
but stick to the max shift exponent for signed 32bit.

UBSAN reported:
UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22
shift exponent 130 is too large for 32-bit type 'int'
CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x183/0x22e lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:148 [inline]
 __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
 __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389
 qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435
 cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180
 qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246
 tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662
 rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564
 netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345
 ___sys_sendmsg net/socket.c:2399 [inline]
 __sys_sendmsg+0x319/0x400 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 net/sched/sch_api.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Cong Wang Jan. 14, 2021, 6:03 p.m. UTC | #1
On Thu, Jan 14, 2021 at 8:06 AM Eric Dumazet <eric.dumazet@gmail.com> wrote:
>
> From: Eric Dumazet <edumazet@google.com>
>
> iproute2 probably never goes beyond 8 for the cell exponent,
> but stick to the max shift exponent for signed 32bit.
>
> UBSAN reported:
> UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22
> shift exponent 130 is too large for 32-bit type 'int'
> CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:79 [inline]
>  dump_stack+0x183/0x22e lib/dump_stack.c:120
>  ubsan_epilogue lib/ubsan.c:148 [inline]
>  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
>  __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389
>  qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435
>  cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180
>  qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246
>  tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662
>  rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564
>  netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494
>  netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
>  netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330
>  netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919
>  sock_sendmsg_nosec net/socket.c:652 [inline]
>  sock_sendmsg net/socket.c:672 [inline]
>  ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345
>  ___sys_sendmsg net/socket.c:2399 [inline]
>  __sys_sendmsg+0x319/0x400 net/socket.c:2432
>  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Acked-by: Cong Wang <cong.wang@bytedance.com>

Thanks.
Jakub Kicinski Jan. 16, 2021, 2:08 a.m. UTC | #2
On Thu, 14 Jan 2021 10:03:39 -0800 Cong Wang wrote:
> On Thu, Jan 14, 2021 at 8:06 AM Eric Dumazet <eric.dumazet@gmail.com> wrote:

> >

> > From: Eric Dumazet <edumazet@google.com>

> >

> > iproute2 probably never goes beyond 8 for the cell exponent,

> > but stick to the max shift exponent for signed 32bit.

> >

> > UBSAN reported:

> > UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22

> > shift exponent 130 is too large for 32-bit type 'int'

> > CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0

> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

> > Call Trace:

> >  __dump_stack lib/dump_stack.c:79 [inline]

> >  dump_stack+0x183/0x22e lib/dump_stack.c:120

> >  ubsan_epilogue lib/ubsan.c:148 [inline]

> >  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395

> >  __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389

> >  qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435

> >  cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180

> >  qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246

> >  tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662

> >  rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564

> >  netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494

> >  netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]

> >  netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330

> >  netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919

> >  sock_sendmsg_nosec net/socket.c:652 [inline]

> >  sock_sendmsg net/socket.c:672 [inline]

> >  ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345

> >  ___sys_sendmsg net/socket.c:2399 [inline]

> >  __sys_sendmsg+0x319/0x400 net/socket.c:2432

> >  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46

> >  entry_SYSCALL_64_after_hwframe+0x44/0xa9

> >

> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

> > Signed-off-by: Eric Dumazet <edumazet@google.com>

> > Reported-by: syzbot <syzkaller@googlegroups.com>  

> 

> Acked-by: Cong Wang <cong.wang@bytedance.com>


Applied, thanks!
diff mbox series

Patch

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 51cb553e4317a3e2bca1996e0df004aab8111d58..6fe4e5cc807c90b046a16f014df43bfe841cbc43 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -412,7 +412,8 @@  struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
 {
 	struct qdisc_rate_table *rtab;
 
-	if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
+	if (tab == NULL || r->rate == 0 ||
+	    r->cell_log == 0 || r->cell_log >= 32 ||
 	    nla_len(tab) != TC_RTAB_SIZE) {
 		NL_SET_ERR_MSG(extack, "Invalid rate table parameters for searching");
 		return NULL;