Eric Dumazet e9789c7cc1 sch_cbq: validate TCA_CBQ_WRROPT to avoid crash ... syzbot reported a crash in cbq_normalize_quanta() caused by an out of range cl->priority. iproute2 enforces this check, but malicious users do not. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI Modules linked in: CPU: 1 PID: 26447 Comm: syz-executor.1 Not tainted 5.3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:cbq_normalize_quanta.part.0+0x1fd/0x430 net/sched/sch_cbq.c:902 RSP: 0018:ffff8801a5c333b0 EFLAGS: 00010206 RAX: 0000000020000003 RBX: 00000000fffffff8 RCX: ffffc9000712f000 RDX: 00000000000043bf RSI: ffffffff83be8962 RDI: 0000000100000018 RBP: ffff8801a5c33420 R08: 000000000000003a R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000002ef R13: ffff88018da95188 R14: dffffc0000000000 R15: 0000000000000015 FS: 00007f37d26b1700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004c7cec CR3: 00000001bcd0a006 CR4: 00000000001626f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffff83be9d57>] cbq_normalize_quanta include/net/pkt_sched.h:27 [inline] [<ffffffff83be9d57>] cbq_addprio net/sched/sch_cbq.c:1097 [inline] [<ffffffff83be9d57>] cbq_set_wrr+0x2d7/0x450 net/sched/sch_cbq.c:1115 [<ffffffff83bee8a7>] cbq_change_class+0x987/0x225b net/sched/sch_cbq.c:1537 [<ffffffff83b96985>] tc_ctl_tclass+0x555/0xcd0 net/sched/sch_api.c:2329 [<ffffffff83a84655>] rtnetlink_rcv_msg+0x485/0xc10 net/core/rtnetlink.c:5248 [<ffffffff83cadf0a>] netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2510 [<ffffffff83a7db6d>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5266 [<ffffffff83cac2c6>] netlink_unicast_kernel net/netlink/af_netlink.c:1324 [inline] [<ffffffff83cac2c6>] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1350 [<ffffffff83cacd4a>] netlink_sendmsg+0x89a/0xd50 net/netlink/af_netlink.c:1939 [<ffffffff8399d46e>] sock_sendmsg_nosec net/socket.c:673 [inline] [<ffffffff8399d46e>] sock_sendmsg+0x12e/0x170 net/socket.c:684 [<ffffffff8399f1fd>] ___sys_sendmsg+0x81d/0x960 net/socket.c:2359 [<ffffffff839a2d05>] __sys_sendmsg+0x105/0x1d0 net/socket.c:2397 [<ffffffff839a2df9>] SYSC_sendmsg net/socket.c:2406 [inline] [<ffffffff839a2df9>] SyS_sendmsg+0x29/0x30 net/socket.c:2404 [<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305 [<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-09-30 11:07:46 -07:00
..
act_api.c	net_sched: add policy validation for action attributes	2019-09-21 19:33:13 -07:00
act_bpf.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_connmark.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_csum.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_ct.c	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
act_ctinfo.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_gact.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_ife.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_ipt.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_meta_mark.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_mirred.c	net: sched: use get_dev() action API in flow_action infra	2019-09-16 09:18:03 +02:00
act_mpls.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_nat.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_pedit.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_police.c	net_sched: act_police: add 2 new attributes to support police 64bit rate and peakrate	2019-09-06 15:02:16 +02:00
act_sample.c	net/sched: act_sample: don't push mac header on ip6gre ingress	2019-09-20 17:01:59 -07:00
act_simple.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_skbedit.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_skbmod.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_tunnel_key.c	net_sched: fix a NULL pointer deref in ipt action	2019-08-27 15:05:58 -07:00
act_vlan.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-09-02 11:20:17 -07:00
cls_api.c	net: sched: fix possible crash in tcf_action_destroy()	2019-09-24 16:33:57 +02:00
cls_basic.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_bpf.c	net: sched: refactor block offloads counter usage	2019-08-26 14:17:43 -07:00
cls_cgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_flow.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_flower.c	net: sched: flower: don't take rtnl lock for cls hw offloads API	2019-08-26 14:17:43 -07:00
cls_fw.c	net: sched: remove NET_CLS_IND config option	2019-06-15 14:06:13 -07:00
cls_matchall.c	net: sched: cls_matchall: cleanup flow_action before deallocating	2019-08-30 15:12:05 -07:00
cls_route.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_rsvp6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_rsvp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_rsvp.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_tcindex.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
cls_u32.c	net: sched: refactor block offloads counter usage	2019-08-26 14:17:43 -07:00
em_canid.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 11	2019-05-21 11:28:45 +02:00
em_cmp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_ipset.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
em_ipt.c	net: sched: em_ipt: add support for addrtype matching	2019-06-29 11:15:12 -07:00
em_meta.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_nbyte.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_text.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_u32.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ematch.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
Kconfig	net/sched: Set default of CONFIG_NET_TC_SKB_EXT to N	2019-09-27 20:08:28 +02:00
Makefile	net/sched: Introduce action ct	2019-07-09 12:11:59 -07:00
sch_api.c	net_sched: add max len check for TCA_KIND	2019-09-21 19:18:51 -07:00
sch_atm.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
sch_blackhole.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_cake.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
sch_cbq.c	sch_cbq: validate TCA_CBQ_WRROPT to avoid crash	2019-09-30 11:07:46 -07:00
sch_cbs.c	net/sched: cbs: Fix not adding cbs instance to list	2019-09-26 09:03:03 +02:00
sch_choke.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_codel.c	net: sched: Fix a possible null-pointer dereference in dequeue_func()	2019-07-29 09:46:58 -07:00
sch_drr.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_dsmark.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
sch_etf.c	etf: Add skip_sock_check	2019-06-28 14:45:33 -07:00
sch_fifo.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_fq_codel.c	fq_codel: remove set but not used variables 'prev_ecn_mark' and 'prev_drop_count'	2019-08-08 22:32:19 -07:00
sch_fq.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_generic.c	net_sched: let qdisc_put() accept NULL pointer	2019-09-15 20:54:14 +02:00
sch_gred.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_hfsc.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
sch_hhf.c	sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero	2019-09-10 18:31:00 +01:00
sch_htb.c	net: sched: sch_htb: don't call qdisc_put() while holding tree lock	2019-09-27 12:13:55 +02:00
sch_ingress.c	net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*	2019-07-09 14:38:50 -07:00
sch_mq.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_mqprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_multiq.c	net: sched: multiq: don't call qdisc_put() while holding tree lock	2019-09-27 12:13:55 +02:00
sch_netem.c	sch_netem: fix rcu splat in netem_enqueue()	2019-09-27 10:29:11 +02:00
sch_pie.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 235	2019-06-19 17:09:07 +02:00
sch_plug.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_prio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_qfq.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_red.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_sfb.c	net: sched: sch_sfb: don't call qdisc_put() while holding tree lock	2019-09-27 12:13:55 +02:00
sch_sfq.c	net_sched: unset TCQ_F_CAN_BYPASS when adding filters	2019-07-17 13:34:09 -07:00
sch_skbprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_taprio.c	taprio: Add support for hardware offloading	2019-09-16 21:32:57 +02:00
sch_tbf.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_teql.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00