This is a note to let you know that I've just added the patch titled pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: pkt_sched-fq-do-not-accept-silly-tca_fq_quantum.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sat 11 Jan 2020 09:13:20 AM CET From: Eric Dumazet <edumazet@xxxxxxxxxx> Date: Mon, 6 Jan 2020 06:10:39 -0800 Subject: pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM From: Eric Dumazet <edumazet@xxxxxxxxxx> [ Upstream commit d9e15a2733067c9328fb56d98fe8e574fa19ec31 ] As diagnosed by Florian : If TCA_FQ_QUANTUM is set to 0x80000000, fq_deueue() can loop forever in : if (f->credit <= 0) { f->credit += q->quantum; goto begin; } ... because f->credit is either 0 or -2147483648. Let's limit TCA_FQ_QUANTUM to no more than 1 << 20 : This max value should limit risks of breaking user setups while fixing this bug. Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Diagnosed-by: Florian Westphal <fw@xxxxxxxxx> Reported-by: syzbot+dc9071cc5a85950bdfce@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sched/sch_fq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/sched/sch_fq.c +++ b/net/sched/sch_fq.c @@ -787,10 +787,12 @@ static int fq_change(struct Qdisc *sch, if (tb[TCA_FQ_QUANTUM]) { u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]); - if (quantum > 0) + if (quantum > 0 && quantum <= (1 << 20)) { q->quantum = quantum; - else + } else { + NL_SET_ERR_MSG_MOD(extack, "invalid quantum"); err = -EINVAL; + } } if (tb[TCA_FQ_INITIAL_QUANTUM]) Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-5.4/vlan-vlan_changelink-should-propagate-errors.patch queue-5.4/net-usb-lan78xx-fix-possible-skb-leak.patch queue-5.4/bpf-clear-skb-tstamp-in-bpf_redirect-when-necessary.patch queue-5.4/pkt_sched-fq-do-not-accept-silly-tca_fq_quantum.patch queue-5.4/vlan-fix-memory-leak-in-vlan_dev_set_egress_priority.patch queue-5.4/gtp-fix-bad-unlock-balance-in-gtp_encap_enable_socket.patch queue-5.4/macvlan-do-not-assume-mac_header-is-set-in-macvlan_broadcast.patch queue-5.4/tcp-fix-old-stuff-d-sack-causing-sack-to-be-treated-as-d-sack.patch