]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
sch_sfq: validate silly quantum values
authorEric Dumazet <edumazet@google.com>
Mon, 27 Apr 2020 01:19:07 +0000 (18:19 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 27 Apr 2020 18:49:57 +0000 (11:49 -0700)
commitdf4953e4e997e273501339f607b77953772e3559
treeb6ebd6e34cfd0d4459e5f103f3b633f8cc1504f5
parentcf7fc3af87b2d767f55eeec9faeb4b45b929341c
sch_sfq: validate silly quantum values

syzbot managed to set up sfq so that q->scaled_quantum was zero,
triggering an infinite loop in sfq_dequeue()

More generally, we must only accept quantum between 1 and 2^18 - 7,
meaning scaled_quantum must be in [1, 0x7FFF] range.

Otherwise, we also could have a loop in sfq_dequeue()
if scaled_quantum happens to be 0x8000, since slot->allot
could indefinitely switch between 0 and 0x8000.

Fixes: eeaeb068f139 ("sch_sfq: allow big packets and be fair")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+0251e883fe39e7a0cb0a@syzkaller.appspotmail.com
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/sch_sfq.c