linux-kernel - Re: [syzbot] [net?] WARNING in taprio_get_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6868f014.a00a0220.c7b3.0033.GAE@google.com>
Date: Sat, 05 Jul 2025 02:27:48 -0700
From: syzbot <syzbot+398e1ee4ca2cac05fddb@...kaller.appspotmail.com>
To: takamitz@...zon.co.jp
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, 
	takamitz@...zon.co.jp, takamitz@...zon.com
Subject: Re: [syzbot] [net?] WARNING in taprio_get_start_time (2)

> I found validation does not work properly when link speed is large.
> picos_per_byte becomes too small when link speed is large, and
> length_to_duration(q, ETH_ZLEN) becomes zero. This results in failing
> validation in fill_sched_entry() and parse_taprio_schedule(), and any
> entry->interval and cycle_time are permitted.
>
> picos_per_byte should be larger than 16 because ETH_ZLEN (60) *
> &q->picos_per_byte should be larger than PSEC_PER_NSEC=1000.
>
> This report seems to be related this, so let me check the following patch
> resolve the issue.
>
> #syz test

This crash does not have a reproducer. I cannot test it.

>
> diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
> index 2b14c81a87e5..b0a5bd1c9995 100644
> --- a/net/sched/sch_taprio.c
> +++ b/net/sched/sch_taprio.c
> @@ -43,6 +43,11 @@ static struct static_key_false taprio_have_working_mqprio;
>  #define TAPRIO_SUPPORTED_FLAGS \
>  	(TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST | TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD)
>  #define TAPRIO_FLAGS_INVALID U32_MAX
> +/* picos_per_byte should be larger than 16 since duration for minimum ethernet
> + * frame should not be zero.
> + */
> +#define TAPRIO_PICOS_PER_BYTE_MIN 17
> +
>  
>  struct sched_entry {
>  	/* Durations between this GCL entry and the GCL entry where the
> @@ -1299,7 +1304,7 @@ static void taprio_set_picos_per_byte(struct net_device *dev,
>  		speed = ecmd.base.speed;
>  
>  skip:
> -	picos_per_byte = (USEC_PER_SEC * 8) / speed;
> +	picos_per_byte = max((USEC_PER_SEC * 8) / speed, TAPRIO_PICOS_PER_BYTE_MIN);
>  
>  	atomic64_set(&q->picos_per_byte, picos_per_byte);
>  	netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n",