linux-kernel - Re: [syzbot] [net?] WARNING in taprio_get_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250705092739.28018-1-takamitz@amazon.co.jp>
Date: Sat, 5 Jul 2025 18:27:39 +0900
From: Takamitsu Iwai <takamitz@...zon.co.jp>
To: <syzbot+398e1ee4ca2cac05fddb@...kaller.appspotmail.com>
CC: <takamitz@...zon.com>, <linux-kernel@...r.kernel.org>,
	<syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [net?] WARNING in taprio_get_start_time (2)

I found validation does not work properly when link speed is large.
picos_per_byte becomes too small when link speed is large, and
length_to_duration(q, ETH_ZLEN) becomes zero. This results in failing
validation in fill_sched_entry() and parse_taprio_schedule(), and any
entry->interval and cycle_time are permitted.

picos_per_byte should be larger than 16 because ETH_ZLEN (60) *
&q->picos_per_byte should be larger than PSEC_PER_NSEC=1000.

This report seems to be related this, so let me check the following patch
resolve the issue.

#syz test

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 2b14c81a87e5..b0a5bd1c9995 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -43,6 +43,11 @@ static struct static_key_false taprio_have_working_mqprio;
 #define TAPRIO_SUPPORTED_FLAGS \
 	(TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST | TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD)
 #define TAPRIO_FLAGS_INVALID U32_MAX
+/* picos_per_byte should be larger than 16 since duration for minimum ethernet
+ * frame should not be zero.
+ */
+#define TAPRIO_PICOS_PER_BYTE_MIN 17
+
 
 struct sched_entry {
 	/* Durations between this GCL entry and the GCL entry where the
@@ -1299,7 +1304,7 @@ static void taprio_set_picos_per_byte(struct net_device *dev,
 		speed = ecmd.base.speed;
 
 skip:
-	picos_per_byte = (USEC_PER_SEC * 8) / speed;
+	picos_per_byte = max((USEC_PER_SEC * 8) / speed, TAPRIO_PICOS_PER_BYTE_MIN);
 
 	atomic64_set(&q->picos_per_byte, picos_per_byte);
 	netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n",