[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 5 May 2021 12:36:26 -0400
From: Sasha Levin <sashal@...nel.org>
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org
Cc: Du Cheng <ducheng2@...il.com>,
syzbot+d50710fd0873a9c6b40c@...kaller.appspotmail.com,
Cong Wang <cong.wang@...edance.com>,
"David S . Miller" <davem@...emloft.net>,
Sasha Levin <sashal@...nel.org>, netdev@...r.kernel.org
Subject: [PATCH AUTOSEL 5.10 63/85] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
From: Du Cheng <ducheng2@...il.com>
[ Upstream commit ed8157f1ebf1ae81a8fa2653e3f20d2076fad1c9 ]
There is a reproducible sequence from the userland that will trigger a WARN_ON()
condition in taprio_get_start_time, which causes kernel to panic if configured
as "panic_on_warn". Catch this condition in parse_taprio_schedule to
prevent this condition.
Reported as bug on syzkaller:
https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c
Reported-by: syzbot+d50710fd0873a9c6b40c@...kaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@...il.com>
Acked-by: Cong Wang <cong.wang@...edance.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
net/sched/sch_taprio.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c966c05a0be9..00853065dfa0 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -900,6 +900,12 @@ static int parse_taprio_schedule(struct taprio_sched *q, struct nlattr **tb,
list_for_each_entry(entry, &new->entries, list)
cycle = ktime_add_ns(cycle, entry->interval);
+
+ if (!cycle) {
+ NL_SET_ERR_MSG(extack, "'cycle_time' can never be 0");
+ return -EINVAL;
+ }
+
new->cycle_time = cycle;
}
--
2.30.2
Powered by blists - more mailing lists