Eric Dumazet bd2474a45d net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check ... [ Upstream commit 343041b59b ] taprio_parse_tc_entry() is not correctly checking TCA_TAPRIO_TC_ENTRY_INDEX attribute: int tc; // Signed value tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]); if (tc >= TC_QOPT_MAX_QUEUE) { NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range"); return -ERANGE; } syzbot reported that it could fed arbitary negative values: UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18 shift exponent -2147418108 is negative CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386 taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline] taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline] taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877 taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134 qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355 tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f1b2dea3759 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340 R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340 Fixes: a54fc09e4c ("net/sched: taprio: allow user input of per-tc max SDU") Reported-and-tested-by: syzbot+a340daa06412d6028918@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-03-26 18:20:59 -04:00
..
act_api.c	net/sched: act_api: add specific EXT_WARN_MSG for tc action	2023-06-21 16:01:02 +02:00
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c	net/sched: act_ct: fix skb leak and crash on ooo frags	2024-01-25 15:27:31 -08:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_ipt.c	net/sched: act_ipt: add sanity checks on skb before calling target	2023-07-19 16:22:01 +02:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: Add carrier check	2023-05-17 11:53:34 +02:00
act_mpls.c	net/sched: act_mpls: fix action bind logic	2023-03-11 13:55:28 +01:00
act_nat.c
act_pedit.c	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX	2023-07-19 16:22:05 +02:00
act_police.c	net: sched: act_police: fix sparse errors in tcf_police_dump()	2023-06-14 11:15:21 +02:00
act_sample.c	net/sched: act_sample: fix action bind logic	2023-03-11 13:55:28 +01:00
act_simple.c
act_skbedit.c
act_skbmod.c
act_tunnel_key.c
act_vlan.c
cls_api.c	net/sched: cls_api: Fix lockup on flushing explicitly created chain	2023-06-21 16:01:01 +02:00
cls_basic.c
cls_bpf.c	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error	2023-07-27 08:50:41 +02:00
cls_cgroup.c
cls_flow.c
cls_flower.c	net/sched: flower: Ensure both minimum and maximum ports are specified	2023-07-23 13:49:26 +02:00
cls_fw.c	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free	2023-08-11 12:08:15 +02:00
cls_matchall.c	net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms	2023-07-27 08:50:41 +02:00
cls_route.c	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free	2023-08-11 12:08:16 +02:00
cls_u32.c	net: sched: cls_u32: Fix allocation size in u32_init()	2023-11-08 14:10:57 +01:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c	net: annotate data-races around sk->sk_lingertime	2023-09-13 09:42:33 +02:00
em_nbyte.c
em_text.c	net: sched: em_text: fix possible memory leak in em_text_destroy()	2024-01-10 17:10:23 +01:00
em_u32.c
ematch.c
Kconfig	net/sched: Retire dsmark qdisc	2024-03-01 13:26:24 +01:00
Makefile	net/sched: Retire dsmark qdisc	2024-03-01 13:26:24 +01:00
sch_api.c	net/sched: fix a qdisc modification with ambiguous command request	2023-08-30 16:11:03 +02:00
sch_blackhole.c
sch_cake.c
sch_cbs.c
sch_choke.c
sch_codel.c
sch_drr.c
sch_etf.c
sch_ets.c
sch_fifo.c
sch_fq.c	net/sched: sch_fq: fix integer overflow of "credit"	2023-05-11 23:03:26 +09:00
sch_fq_codel.c
sch_fq_pie.c	net/sched: fq_pie: avoid stalls in fq_pie_timer()	2023-09-19 12:28:00 +02:00
sch_frag.c
sch_generic.c	net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting	2023-06-21 16:01:01 +02:00
sch_gred.c
sch_hfsc.c	net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve	2023-10-25 12:03:07 +02:00
sch_hhf.c
sch_htb.c
sch_ingress.c	net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs	2023-06-09 10:34:03 +02:00
sch_mq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00
sch_mqprio.c	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64	2023-08-03 10:24:02 +02:00
sch_multiq.c
sch_netem.c	sch_netem: fix issues in netem_change() vs get_dist_table()	2023-08-16 18:27:31 +02:00
sch_pie.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00
sch_plug.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-19 12:28:02 +02:00
sch_prio.c
sch_qfq.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-19 12:28:02 +02:00
sch_red.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00
sch_sfb.c
sch_sfq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00
sch_skbprio.c
sch_taprio.c	net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check	2024-03-26 18:20:59 -04:00
sch_tbf.c
sch_teql.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00