netdev - Re: [PATCH net] net_sched: reject silly cell_log in qdisc_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210115180839.725064b2@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Fri, 15 Jan 2021 18:08:39 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Cong Wang <xiyou.wangcong@...il.com>,
        Eric Dumazet <eric.dumazet@...il.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        syzbot <syzkaller@...glegroups.com>
Subject: Re: [PATCH net] net_sched: reject silly cell_log in
 qdisc_get_rtab()

On Thu, 14 Jan 2021 10:03:39 -0800 Cong Wang wrote:
> On Thu, Jan 14, 2021 at 8:06 AM Eric Dumazet <eric.dumazet@...il.com> wrote:
> >
> > From: Eric Dumazet <edumazet@...gle.com>
> >
> > iproute2 probably never goes beyond 8 for the cell exponent,
> > but stick to the max shift exponent for signed 32bit.
> >
> > UBSAN reported:
> > UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22
> > shift exponent 130 is too large for 32-bit type 'int'
> > CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Call Trace:
> >  __dump_stack lib/dump_stack.c:79 [inline]
> >  dump_stack+0x183/0x22e lib/dump_stack.c:120
> >  ubsan_epilogue lib/ubsan.c:148 [inline]
> >  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
> >  __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389
> >  qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435
> >  cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180
> >  qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246
> >  tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662
> >  rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564
> >  netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494
> >  netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
> >  netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330
> >  netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919
> >  sock_sendmsg_nosec net/socket.c:652 [inline]
> >  sock_sendmsg net/socket.c:672 [inline]
> >  ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345
> >  ___sys_sendmsg net/socket.c:2399 [inline]
> >  __sys_sendmsg+0x319/0x400 net/socket.c:2432
> >  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> >  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> > Reported-by: syzbot <syzkaller@...glegroups.com>  
> 
> Acked-by: Cong Wang <cong.wang@...edance.com>

Applied, thanks!