This is a note to let you know that I've just added the patch titled
pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
pkt_sched-fq-do-not-accept-silly-tca_fq_quantum.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Sat 11 Jan 2020 09:14:34 AM CET
From: Eric Dumazet <edumazet@xxxxxxxxxx>
Date: Mon, 6 Jan 2020 06:10:39 -0800
Subject: pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
From: Eric Dumazet <edumazet@xxxxxxxxxx>
[ Upstream commit d9e15a2733067c9328fb56d98fe8e574fa19ec31 ]
As diagnosed by Florian :
If TCA_FQ_QUANTUM is set to 0x80000000, fq_deueue()
can loop forever in :
if (f->credit <= 0) {
f->credit += q->quantum;
goto begin;
}
... because f->credit is either 0 or -2147483648.
Let's limit TCA_FQ_QUANTUM to no more than 1 << 20 :
This max value should limit risks of breaking user setups
while fixing this bug.
Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler")
Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
Diagnosed-by: Florian Westphal <fw@xxxxxxxxx>
Reported-by: syzbot+dc9071cc5a85950bdfce@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sched/sch_fq.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -735,10 +735,12 @@ static int fq_change(struct Qdisc *sch,
if (tb[TCA_FQ_QUANTUM]) {
u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
- if (quantum > 0)
+ if (quantum > 0 && quantum <= (1 << 20)) {
q->quantum = quantum;
- else
+ } else {
+ NL_SET_ERR_MSG_MOD(extack, "invalid quantum");
err = -EINVAL;
+ }
}
if (tb[TCA_FQ_INITIAL_QUANTUM])
Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are
queue-4.19/vlan-vlan_changelink-should-propagate-errors.patch
queue-4.19/net-usb-lan78xx-fix-possible-skb-leak.patch
queue-4.19/bpf-clear-skb-tstamp-in-bpf_redirect-when-necessary.patch
queue-4.19/pkt_sched-fq-do-not-accept-silly-tca_fq_quantum.patch
queue-4.19/vlan-fix-memory-leak-in-vlan_dev_set_egress_priority.patch
queue-4.19/gtp-fix-bad-unlock-balance-in-gtp_encap_enable_socket.patch
queue-4.19/macvlan-do-not-assume-mac_header-is-set-in-macvlan_broadcast.patch
queue-4.19/tcp-fix-old-stuff-d-sack-causing-sack-to-be-treated-as-d-sack.patch
