]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
net_sched: fix an OOB access in cls_tcindex
authorCong Wang <xiyou.wangcong@gmail.com>
Mon, 3 Feb 2020 05:14:35 +0000 (21:14 -0800)
committerPaolo Pisati <paolo.pisati@canonical.com>
Mon, 17 Feb 2020 09:57:34 +0000 (10:57 +0100)
commitc03100da8ce662b871a5dc24e37fa262e24e8de8
treec0e2d6481bee3acf1a786877bd17a590bbc83379
parent82bf41a1bbf02cf25aa379caa25ff53afd8d274c
net_sched: fix an OOB access in cls_tcindex

BugLink: https://bugs.launchpad.net/bugs/1863588
[ Upstream commit 599be01ee567b61f4471ee8078870847d0a11e8e ]

As Eric noticed, tcindex_alloc_perfect_hash() uses cp->hash
to compute the size of memory allocation, but cp->hash is
set again after the allocation, this caused an out-of-bound
access.

So we have to move all cp->hash initialization and computation
before the memory allocation. Move cp->mask and cp->shift together
as cp->hash may need them for computation too.

Reported-and-tested-by: syzbot+35d4dea36c387813ed31@syzkaller.appspotmail.com
Fixes: 331b72922c5f ("net: sched: RCU cls_tcindex")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
net/sched/cls_tcindex.c