netdev - Re: [PATCH net 1/1] net_sched: sch_fq: Fix out of range band computation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM0EoMm8sRhONAJj6OhJ_+9BmzzSV71F=LuCWze_0Mc1h9V+kQ@mail.gmail.com>
Date: Wed, 13 Dec 2023 12:53:09 -0500
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Willem de Bruijn <willemb@...gle.com>, davem@...emloft.net, kuba@...nel.org, 
	pabeni@...hat.com, jiri@...nulli.us, xiyou.wangcong@...il.com, 
	netdev@...r.kernel.org, pctammela@...atatu.com, victor@...atatu.com, 
	Coverity Scan <scan-admin@...erity.com>
Subject: Re: [PATCH net 1/1] net_sched: sch_fq: Fix out of range band computation

On Wed, Dec 13, 2023 at 12:42 PM Eric Dumazet <edumazet@...gle.com> wrote:
>
> On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet <edumazet@...gle.com> wrote:
> >
> > On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@...atatu.com> wrote:
> > >
> > > It is possible to compute a band of 3. Doing so will overrun array
> > > q->band_pkt_count[0-2] boundaries.
> > >
> > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
> > > Reported-by: Coverity Scan <scan-admin@...erity.com>
> > > Signed-off-by: Jamal Hadi Salim <jhs@...atatu.com>
> > > ---
> > >  net/sched/sch_fq.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
> > > index 3a31c47fea9b..217c430343df 100644
> > > --- a/net/sched/sch_fq.c
> > > +++ b/net/sched/sch_fq.c
> > > @@ -159,7 +159,7 @@ struct fq_sched_data {
> > >  /* return the i-th 2-bit value ("crumb") */
> > >  static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
> > >  {
> > > -       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
> > > +       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
> > >  }
> > >
> >
> > Are you sure this is needed ?
> >
> > fq_load_priomap() makes sure this can not happen...
>
> Yeah, I am pretty sure this patch is incorrect, we need to mask to get
> only two bits.

The check in fq_load_priomap() is what makes it moot. Masking with
b'11 could result in b'11. Definitely the modulo will guarantee
whatever results can only be in the range 0..2. But it is not needed.

cheers,
jamal