Cong Wang 9bfa1646d7 net_sched: fix datalen for ematch
[ Upstream commit 61678d28d4a45ef376f5d02a839cc37509ae9281 ]

syzbot reported an out-of-bound access in em_nbyte. As initially
analyzed by Eric, this is because em_nbyte sets its own em->datalen
in em_nbyte_change() other than the one specified by user, but this
value gets overwritten later by its caller tcf_em_validate().
We should leave em->datalen untouched to respect their choices.

I audit all the in-tree ematch users, all of those implement
->change() set em->datalen, so we can just avoid setting it twice
in this case.

Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-29 10:21:51 +01:00
..
2019-12-05 15:27:07 +01:00
2020-01-29 10:21:51 +01:00
2019-09-16 08:13:35 +02:00
2015-10-07 04:27:43 -07:00
2019-06-22 08:18:25 +02:00
2019-03-23 08:44:34 +01:00
2020-01-29 10:21:51 +01:00
2019-11-28 18:25:43 +01:00
2019-09-16 08:13:35 +02:00
2019-01-13 10:05:28 +01:00
2018-02-25 11:03:37 +01:00
2020-01-23 08:18:37 +01:00