Eric Dumazet f642700279 net: sched: validate stab values ... [ Upstream commit e323d865b3 ] iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports. Add stab parameter to red_check_params() to validate user input. syzbot reported: UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] Fixes: 8afa10cbe2 ("net_sched: red: Avoid illegal values") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-03-30 14:31:57 +02:00
..
acpi	ACPICA: Fix exception code class checks	2021-03-04 11:37:24 +01:00
asm-generic	static_call: Allow module use without exposing static_call_key	2021-03-30 14:31:53 +02:00
clocksource
crypto	crypto - shash: reduce minimum alignment of shash_desc structure	2021-03-09 11:11:13 +01:00
drm	drm/dp/mst: Export drm_dp_get_vc_payload_bw()	2021-02-10 09:29:18 +01:00
dt-bindings	ASoC: dt-bindings: lpass: Fix and common up lpass dai ids	2021-02-03 23:28:46 +01:00
keys
kunit	kunit: fix display of failed expectations for strings	2020-11-10 13:45:15 -07:00
kvm	ARM:	2020-10-23 11:17:56 -07:00
linux	macvlan: macvlan_count_rx() needs to be aware of preemption	2021-03-30 14:31:57 +02:00
math-emu
media	media: rc: compile rc-cec.c into rc-core	2021-03-17 17:06:20 +01:00
memory
misc
net	net: sched: validate stab values	2021-03-30 14:31:57 +02:00
pcmcia
ras
rdma	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
scsi	scsi: libsas: Introduce a _gfp() variant of event notifiers	2021-03-25 09:04:11 +01:00
soc	net: dsa: felix: implement port flushing on .phylink_mac_link_down	2021-02-17 11:02:27 +01:00
sound	ALSA: hda: intel-nhlt: verify config type	2021-03-09 11:11:14 +01:00
target	scsi: target: core: Add cmd length set before cmd complete	2021-03-17 17:06:25 +01:00
trace	trace: fix potenial dangerous pointer	2020-11-25 13:03:44 +01:00
uapi	psample: Fix user API breakage	2021-03-30 14:31:53 +02:00
vdso
video	gpu: ipu-v3: remove unused functions	2020-10-26 10:42:38 +01:00
xen	Xen/gntdev: correct error checking in gntdev_map_grant_pages()	2021-02-23 15:53:24 +01:00