Eric Dumazet f642700279 net: sched: validate stab values ... [ Upstream commit e323d865b3 ] iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports. Add stab parameter to red_check_params() to validate user input. syzbot reported: UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] Fixes: 8afa10cbe2 ("net_sched: red: Avoid illegal values") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-03-30 14:31:57 +02:00
..
6lowpan
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-10-12 10:05:47 +02:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix atalk_proc_init() return path	2020-08-03 15:48:32 -07:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-07-25 17:49:04 -07:00
batman-adv	batman-adv: Don't always reallocate the fragmentation skb head	2020-11-27 08:02:55 +01:00
bluetooth	Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data	2021-03-07 12:34:10 +01:00
bpf	bpf: Reject too big ctx_size_in for raw_tp test run	2021-01-27 11:55:07 +01:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	net: bridge: use switchdev for port flags set through sysfs too	2021-03-07 12:34:07 +01:00
caif	caif: Remove duplicate macro SRVL_CTRL_PKT_SIZE	2020-09-05 15:57:05 -07:00
can	can: isotp: isotp_getname(): fix kernel information leak	2021-01-17 14:17:05 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	drop_monitor: Perform cleanup upon probe registration failure	2021-03-30 14:31:57 +02:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
decnet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dns_resolver
dsa	net: dsa: tag_mtk: fix 802.1ad VLAN egress	2021-03-17 17:06:22 +01:00
ethernet
ethtool	ethtool: fix the check logic of at least one channel for RX/TX	2021-03-17 17:06:16 +01:00
hsr	net: hsr: add support for EntryForgetTime	2021-03-07 12:34:07 +01:00
ieee802154	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ife
ipv4	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
ipv6	ipv6: fix suspecious RCU usage warning	2021-03-30 14:31:57 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev	net: Fix some comments	2020-08-27 07:55:59 -07:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
mac80211	mac80211: fix potential overflow when multiplying to u32 integers	2021-03-04 11:37:32 +01:00
mac802154	Merge tag 'ieee802154-for-davem-2020-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan	2020-09-08 20:12:58 -07:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: do not wakeup listener for MPJ subflows	2021-03-07 12:34:06 +01:00
ncsi	net/ncsi: Use real net-device for response handler	2021-01-12 20:18:10 +01:00
netfilter	netfilter: x_tables: gpf inside xt_find_revision()	2021-03-17 17:06:12 +01:00
netlabel	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nfc	tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer	2021-03-04 11:37:36 +01:00
nsh
openvswitch	net: openvswitch: fix TTL decrement exception action execution	2021-02-23 15:53:23 +01:00
packet	net: fix proc_fs init handling in af_packet and tls	2021-02-23 15:53:23 +01:00
phonet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net/qrtr: fix __netdev_alloc_skb call	2021-03-25 09:04:09 +01:00
rds	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	net: sched: validate stab values	2021-03-30 14:31:57 +02:00
sctp	net: fix iteration for sctp transport seq_files	2021-02-17 11:02:29 +01:00
smc	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()	2020-11-19 10:59:19 -08:00
strparser
sunrpc	sunrpc: fix refcount leak for rpc auth modules	2021-03-25 09:04:08 +01:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: fix NULL deref in tipc_link_xmit()	2021-01-23 16:04:00 +01:00
tls	net: fix proc_fs init handling in af_packet and tls	2021-02-23 15:53:23 +01:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	vsock: fix locking in vsock_shutdown()	2021-02-17 11:02:30 +01:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	wext: fix NULL-ptr-dereference with cfg80211's lack of commit()	2021-02-03 23:28:38 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-02 17:26:36 -08:00
xdp	xsk: Clear pool even for inactive queues	2021-01-27 11:55:10 +01:00
xfrm	xfrm: Fix wraparound in xfrm_policy_addr_delta()	2021-02-03 23:28:45 +01:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
sysctl_net.c