netdev - Re: [PATCH v2] netem: fix zero division in tabledist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20201029114648.64e00e22@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Thu, 29 Oct 2020 11:46:48 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     Aleksandr Nogikh <aleksandrnogikh@...il.com>, jhs@...atatu.com,
        xiyou.wangcong@...il.com, jiri@...nulli.us, davem@...emloft.net,
        andreyknvl@...gle.com, dvyukov@...gle.com, elver@...gle.com,
        rdunlap@...radead.org, dave.taht@...il.com, edumazet@...gle.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Aleksandr Nogikh <nogikh@...gle.com>,
        syzbot+ec762a6342ad0d3c0d8f@...kaller.appspotmail.com
Subject: Re: [PATCH v2] netem: fix zero division in tabledist

On Wed, 28 Oct 2020 11:19:59 -0700 Stephen Hemminger wrote:
> On Wed, 28 Oct 2020 17:07:31 +0000
> Aleksandr Nogikh <aleksandrnogikh@...il.com> wrote:
> 
> > From: Aleksandr Nogikh <nogikh@...gle.com>
> > 
> > Currently it is possible to craft a special netlink RTM_NEWQDISC
> > command that can result in jitter being equal to 0x80000000. It is
> > enough to set the 32 bit jitter to 0x02000000 (it will later be
> > multiplied by 2^6) or just set the 64 bit jitter via
> > TCA_NETEM_JITTER64. This causes an overflow during the generation of
> > uniformly distributed numbers in tabledist(), which in turn leads to
> > division by zero (sigma != 0, but sigma * 2 is 0).
> > 
> > The related fragment of code needs 32-bit division - see commit
> > 9b0ed89 ("netem: remove unnecessary 64 bit modulus"), so switching to
> > 64 bit is not an option.
> > 
> > Fix the issue by keeping the value of jitter within the range that can
> > be adequately handled by tabledist() - [0;INT_MAX]. As negative std
> > deviation makes no sense, take the absolute value of the passed value
> > and cap it at INT_MAX. Inside tabledist(), switch to unsigned 32 bit
> > arithmetic in order to prevent overflows.
> > 
> > Signed-off-by: Aleksandr Nogikh <nogikh@...gle.com>
> > Reported-by: syzbot+ec762a6342ad0d3c0d8f@...kaller.appspotmail.com  
> 
> Acked-by: Stephen Hemminger <stephen@...workplumber.org>

Applied, thanks!