net: Properly typecast int values to set sk_max_pacing_rate

BugLink: https://bugs.launchpad.net/bugs/1902115
[ Upstream commit 700465fd338fe5df08a1b2e27fa16981f562547f ]

In setsockopt(SO_MAX_PACING_RATE) on 64bit systems, sk_max_pacing_rate,
after extended from 'u32' to 'unsigned long', takes unintentionally
hiked value whenever assigned from an 'int' value with MSB=1, due to
binary sign extension in promoting s32 to u64, e.g. 0x80000000 becomes
0xFFFFFFFF80000000.

Thus inflated sk_max_pacing_rate causes subsequent getsockopt to return
~0U unexpectedly. It may also result in increased pacing rate.

Fix by explicitly casting the 'int' value to 'unsigned int' before
assigning it to sk_max_pacing_rate, for zero extension to happen.

Fixes: 76a9ebe811fb ("net: extend sk_pacing_rate to unsigned long")
Signed-off-by: Ji Li <jli@akamai.com>
Signed-off-by: Ke Li <keli@akamai.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201022064146.79873-1-keli@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Ian May <ian.may@canonical.com>

diff --git a/net/core/filter.c b/net/core/filter.c
index d244b6c8f06dd3744deb05cb17cf819a6165211d..5712ef631393e1a4b5110981c93cd775b48aead7 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4270,7 +4270,8 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                                cmpxchg(&sk->sk_pacing_status,
                                        SK_PACING_NONE,
                                        SK_PACING_NEEDED);
-                       sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
+                       sk->sk_max_pacing_rate = (val == ~0U) ?
+                                                ~0UL : (unsigned int)val;
                        sk->sk_pacing_rate = min(sk->sk_pacing_rate,
                                                 sk->sk_max_pacing_rate);
                        break;

diff --git a/net/core/sock.c b/net/core/sock.c
index 9a186d2ad36dc65ba2f3e1d09f797a5e30a1959f..1b765e62658f04b36399ae673eb370095779df1b 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1106,7 +1106,7 @@ set_rcvbuf:
 
        case SO_MAX_PACING_RATE:
                {
-               unsigned long ulval = (val == ~0U) ? ~0UL : val;
+               unsigned long ulval = (val == ~0U) ? ~0UL : (unsigned int)val;
 
                if (sizeof(ulval) != sizeof(val) &&
                    optlen >= sizeof(ulval) &&