Eric Dumazet 116555b32d sch_sfq: validate silly quantum values
[ Upstream commit df4953e4e997e273501339f607b77953772e3559 ]

syzbot managed to set up sfq so that q->scaled_quantum was zero,
triggering an infinite loop in sfq_dequeue()

More generally, we must only accept quantum between 1 and 2^18 - 7,
meaning scaled_quantum must be in [1, 0x7FFF] range.

Otherwise, we also could have a loop in sfq_dequeue()
if scaled_quantum happens to be 0x8000, since slot->allot
could indefinitely switch between 0 and 0x8000.

Fixes: eeaeb068f139 ("sch_sfq: allow big packets and be fair")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+0251e883fe39e7a0cb0a@syzkaller.appspotmail.com
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:11:30 +02:00
..
2019-12-05 15:27:07 +01:00
2020-04-02 19:02:34 +02:00
2019-09-16 08:13:35 +02:00
2015-10-07 04:27:43 -07:00
2019-06-22 08:18:25 +02:00
2019-03-23 08:44:34 +01:00
2019-11-28 18:25:43 +01:00
2019-01-13 10:05:28 +01:00
2018-02-25 11:03:37 +01:00
2020-01-23 08:18:37 +01:00