Eric Dumazet fd4c12f312 net_sched: gen_estimator: support large ewma log ... commit dd5e073381 upstream syzbot report reminded us that very big ewma_log were supported in the past, even if they made litle sense. tc qdisc replace dev xxx root est 1sec 131072sec ... While fixing the bug, also add boundary checks for ewma_log, in line with range supported by iproute2. UBSAN: shift-out-of-bounds in net/core/gen_estimator.c:83:38 shift exponent -1 is negative CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395 est_timer.cold+0xbb/0x12d net/core/gen_estimator.c:83 call_timer_fn+0x1a5/0x710 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x692/0xa80 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744 __do_softirq+0x2bc/0xa77 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu+0x17f/0x200 kernel/softirq.c:420 irq_exit_rcu+0x5/0x20 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:79 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:169 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] RIP: 0010:acpi_idle_do_entry+0x1c9/0x250 drivers/acpi/processor_idle.c:516 Fixes: 1c0d32fde5 ("net_sched: gen_estimator: complete rewrite of rate estimators") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20210114181929.1717985-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [sudip: adjust context] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-02-07 15:35:47 +01:00
..
6lowpan
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-11-05 11:43:20 +01:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:05:31 +01:00
appletalk	appletalk: Fix atalk_proc_init() return path	2020-08-11 15:33:40 +02:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:17:58 +02:00
ax25	AX.25: Prevent integer overflows in connect and sendmsg	2020-07-31 18:39:31 +02:00
batman-adv	batman-adv: set .owner to THIS_MODULE	2020-12-02 08:49:50 +01:00
bluetooth	Bluetooth: Fix null pointer dereference in hci_event_packet()	2020-12-30 11:51:05 +01:00
bpf
bpfilter
bridge	bridge: Fix a deadlock when enabling multicast snooping	2020-12-21 13:27:04 +01:00
caif
can	can: af_can: can_rx_unregister(): remove WARN() statement from list operation sanity check	2020-12-11 13:23:32 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:43:34 +01:00
core	net_sched: gen_estimator: support large ewma log	2021-02-07 15:35:47 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 15:57:59 +01:00
dccp
decnet
dns_resolver
dsa	dsa: Allow forwarding of redirected IGMP traffic	2020-09-23 12:40:33 +02:00
ethernet
hsr
ieee802154
ife
ipv4	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-02-07 15:35:47 +01:00
ipv6	IPv6: reply ICMP error if the first fragment don't include all headers	2021-02-03 23:25:55 +01:00
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-12-08 10:40:23 +01:00
kcm
key	af_key: pfkey_dump needs parameter validation	2020-09-26 18:03:10 +02:00
l2tp
l3mdev
lapb
llc	net: silence data-races on sk_backlog.tail	2020-10-01 13:17:15 +02:00
mac80211	mac80211: pause TX while changing interface type	2021-02-03 23:26:00 +01:00
mac802154	mac802154: tx: fix use-after-free	2020-10-01 13:18:17 +02:00
mpls
ncsi	net/ncsi: Use real net-device for response handler	2021-01-12 20:16:13 +01:00
netfilter	netfilter: nft_dynset: add timeout extension to template	2021-02-03 23:25:59 +01:00
netlabel	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()	2020-11-24 13:28:57 +01:00
netlink
netrom
nfc	NFC: fix possible resource leak	2021-02-03 23:26:01 +01:00
nsh
openvswitch	net: openvswitch: ensure LSE is pullable before reading it	2020-12-08 10:40:27 +01:00
packet	net/packet: fix overflow in tpacket_rcv	2020-09-09 19:12:29 +02:00
phonet
psample
qrtr	net: qrtr: check skb_put_padto() return value	2020-09-26 18:03:15 +02:00
rds	rds: Prevent kernel-infoleak in rds_notify_queue_get()	2020-08-05 09:59:44 +02:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-24 13:29:05 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-12-08 10:40:23 +01:00
rxrpc	rxrpc: Fix memory leak in rxrpc_lookup_local	2021-02-03 23:26:01 +01:00
sched	net_sched: reject silly cell_log in qdisc_get_rtab()	2021-01-27 11:47:54 +01:00
sctp	net, sctp, filter: remap copy_from_user failure error	2021-01-23 15:58:00 +01:00
smc	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()	2020-11-24 13:28:58 +01:00
strparser
sunrpc	net: sunrpc: interpret the return value of kstrtou32 correctly	2021-01-19 18:26:18 +01:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:35:46 +01:00
tipc	tipc: fix NULL deref in tipc_link_xmit()	2021-01-23 15:58:00 +01:00
tls	net/tls: Protect from calling tls_dev_del for TLS RX twice	2020-12-08 10:40:23 +01:00
unix	skbuff: fix a data race in skb_queue_len()	2020-10-01 13:17:31 +02:00
vmw_vsock	vsock: use ns_capable_noaudit() on socket create	2020-11-10 12:37:30 +01:00
wimax
wireless	wext: fix NULL-ptr-dereference with cfg80211's lack of commit()	2021-02-03 23:25:56 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-08 10:40:26 +01:00
xdp	xsk: Replace datagram_poll by sock_poll_wait	2020-12-30 11:50:53 +01:00
xfrm	xfrm: Fix wraparound in xfrm_policy_addr_delta()	2021-02-03 23:25:59 +01:00
compat.c	net/compat: Add missing sock updates for SCM_RIGHTS	2020-08-21 13:05:25 +02:00
Kconfig
Makefile
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-19 08:16:22 +02:00
sysctl_net.c