iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/include/net
History
Eric Dumazet e323d865b3 net: sched: validate stab values 
iproute2 package is well behaved, but malicious user space can
provide illegal shift values and trigger UBSAN reports.

Add stab parameter to red_check_params() to validate user input.

syzbot reported:

UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18
shift exponent 111 is too large for 64-bit type 'long unsigned int'
CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 red_calc_qavg_from_idle_time include/net/red.h:312 [inline]
 red_calc_qavg include/net/red.h:353 [inline]
 choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221
 __dev_xmit_skb net/core/dev.c:3837 [inline]
 __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline]
 __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161
 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215
 dst_output include/net/dst.h:448 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 NF_HOOK include/linux/netfilter.h:295 [inline]
 ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320
 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135
 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138
 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535
 dccp_finish_passive_close net/dccp/proto.c:123 [inline]
 dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118
 dccp_terminate_connection net/dccp/proto.c:958 [inline]
 dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028
 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478
 __sock_release+0xcd/0x280 net/socket.c:599
 sock_close+0x18/0x20 net/socket.c:1258
 __fput+0x288/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]

Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-03-10 15:47:52 -08:00
..
9p
9p: apply review requests for fid refcounting
2020-11-19 17:21:34 +01:00
bluetooth
Bluetooth: Skip eSCO 2M params when not supported
2021-02-01 17:04:17 +01:00
caif
net: caif: Remove unused caif SPI driver
2020-09-29 14:02:53 -07:00
iucv
net/af_iucv: don't track individual TX skbs for TRANS_HIPER sockets
2021-01-28 20:36:21 -08:00
netfilter
netfilter: nftables: introduce table ownership
2021-02-15 18:17:15 +01:00
netns
net: ipv6: Emit notification when fib hardware flags are changed
2021-02-02 17:45:59 -08:00
nfc
net/nfc/nci: Support NCI 2.x initial sequence
2020-12-04 17:47:35 -08:00
phonet
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp
sctp: bring inet(6)_skb_parm back to sctp_input_cb
2020-11-05 14:27:30 -08:00
tc_act
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-10-15 12:43:21 -07:00
6lowpan.h
6lowpan: Replace zero-length array with flexible-array member
2020-02-28 14:51:30 +01:00
act_api.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2021-02-16 17:51:13 -08:00
addrconf.h
ipv6: some fixes for ipv6_dev_find()
2020-08-18 15:58:53 -07:00
af_ieee802154.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
af_rxrpc.h
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-08-20 18:21:28 +01:00
af_unix.h
unix: uses an atomic type for scm files accounting
2020-02-28 12:12:53 -08:00
af_vsock.h
vsock: add local transport support in the vsock core
2019-12-11 15:01:23 -08:00
ah.h
…
arp.h
net: avoid potential false sharing in neighbor related code
2019-11-06 16:14:48 -08:00
atmclip.h
…
ax25.h
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
ax88796.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
bareudp.h
bareudp: Reverted support to enable & disable rx metadata collection
2020-07-21 18:30:47 -07:00
bond_3ad.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 90
2019-05-24 17:37:53 +02:00
bond_alb.h
bonding/alb: Add helper functions to get the xmit slave
2020-05-01 12:15:37 -07:00
bond_options.h
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding.h
net/bonding: Declare TLS RX device offload support
2021-01-18 20:48:40 -08:00
bpf_sk_storage.h
bpf: Allow using bpf_sk_storage in FENTRY/FEXIT/RAW_TP
2020-11-12 18:39:28 -08:00
busy_poll.h
net, xdp, xsk: fix __sk_mark_napi_id_once napi_id error
2020-12-01 15:51:19 +01:00
calipso.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
cfg80211-wext.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
cfg80211.h
cfg80211/mac80211: Support disabling HE mode
2021-02-12 09:33:34 +01:00
cfg802154.h
cfg802154: Replace zero-length array with flexible-array member
2020-02-29 14:39:08 +01:00
checksum.h
saner calling conventions for csum_and_copy_..._user()
2020-08-20 15:45:15 -04:00
cipso_ipv4.h
cipso: Remove unused inline functions
2020-07-15 07:45:24 -07:00
cls_cgroup.h
bpf: Allow to retrieve cgroup v1 classid from v2 hooks
2020-03-27 19:40:38 -07:00
codel_impl.h
…
codel_qdisc.h
…
codel.h
…
compat.h
compat: always include linux/compat.h from net/compat.h
2020-11-23 13:31:54 -08:00
datalink.h
…
dcbevent.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
dcbnl.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink.h
devlink: Fix dmac_filter trap name, align to its documentation
2021-02-11 13:04:49 -08:00
dn_dev.h
…
dn_fib.h
net: dn_fib: Replace zero-length array with flexible-array member
2020-02-29 21:52:20 -08:00
dn_neigh.h
…
dn_nsp.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
dn_route.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
dn.h
…
dsa.h
net: dsa: add MRP support
2021-02-16 14:47:46 -08:00
dsfield.h
ipv6: Annotate bitwise IPv6 dsfield pointer cast
2019-12-16 16:09:44 -08:00
dst_cache.h
…
dst_metadata.h
…
dst_ops.h
net/dst: use a smaller percpu_counter batch for dst entries accounting
2020-05-08 21:33:33 -07:00
dst.h
net: Consolidate common blackhole dst ops
2021-03-10 12:24:18 -08:00
erspan.h
erspan: Add type I version 0 support.
2020-05-05 13:23:29 -07:00
esp.h
ESP: Export esp_output_fill_trailer function
2020-02-19 13:52:32 +01:00
espintcp.h
xfrm: espintcp: save and call old ->sk_destruct
2020-04-20 07:34:16 +02:00
ethoc.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
failover.h
…
fib_notifier.h
ipv6: Remove old route notifications and convert listeners
2019-12-24 22:37:30 -08:00
fib_rules.h
fib: use indirect call wrappers in the most common fib_rules_ops
2020-07-28 17:42:31 -07:00
firewire.h
…
flow_dissector.h
net/flow_dissector: add packet hash dissection
2020-07-24 15:23:31 -07:00
flow_offload.h
net: flow_offload: Add original direction flag to ct_metadata
2021-01-29 18:05:30 -08:00
flow.h
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
2020-11-23 18:36:21 -05:00
fou.h
…
fq_impl.h
net/fq_impl: do not maintain a backlog-sorted list of flows
2021-01-21 13:33:45 +01:00
fq.h
net/fq_impl: do not maintain a backlog-sorted list of flows
2021-01-21 13:33:45 +01:00
garp.h
treewide: Use sizeof_field() macro
2019-12-09 10:36:44 -08:00
gen_stats.h
net_sched: extend packet counter to 64bit
2019-11-05 18:20:55 -08:00
genetlink.h
mptcp: avoid lock_fast usage in accept path
2021-02-12 16:31:46 -08:00
geneve.h
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
gre.h
ip_gre: add csum offload support for gre header
2021-01-29 20:39:14 -08:00
gro_cells.h
…
gro.h
net/core: move gro function declarations to separate header
2021-02-04 18:37:57 -08:00
gtp.h
…
gue.h
GUE: Fix a typo
2020-06-22 21:12:44 -07:00
hwbm.h
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
icmp.h
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-02-23 11:29:52 -08:00
ieee80211_radiotap.h
mac80211: add radiotap flag to assure frames are not reordered
2020-11-06 11:01:01 +01:00
ieee802154_netdev.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
if_inet6.h
ipv6: Replace zero-length array with flexible-array
2020-05-11 13:18:54 -07:00
ife.h
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
ila.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet6_connection_sock.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet6_hashtables.h
net: Track socket refcounts in skb_steal_sock()
2020-03-30 13:45:04 -07:00
inet_common.h
bpf: Allow rewriting to ports under ip_unprivileged_port_start
2021-01-27 18:18:15 -08:00
inet_connection_sock.h
tcp: shrink inet_connection_sock icsk_mtup enabled and probe_size
2021-01-29 22:48:30 -08:00
inet_ecn.h
inet_ecn: Use csum16_add() helper for IP_ECN_set_* helpers
2020-12-14 18:38:58 -08:00
inet_frag.h
inet: frags: batch fqdir destroy works
2020-12-12 15:08:54 -08:00
inet_hashtables.h
tcp: fix race condition when creating child sockets from syncookies
2020-11-23 16:32:33 -08:00
inet_sock.h
inet: remove inet_sk_copy_descendant()
2020-08-26 07:33:19 -07:00
inet_timewait_sock.h
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
inetpeer.h
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
ip6_checksum.h
tcp: remove indirect calls for icsk->icsk_af_ops->send_check
2020-06-20 17:47:53 -07:00
ip6_fib.h
IPv6: Add "offload failed" indication to routes
2021-02-08 16:47:03 -08:00
ip6_route.h
net: allow user to set metric on default route learned via Router Advertisement
2021-01-26 18:39:45 -08:00
ip6_tunnel.h
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
ip_fib.h
IPv4: Add "offload failed" indication to routes
2021-02-08 16:47:03 -08:00
ip_tunnels.h
Merge https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-11-19 19:08:46 -08:00
ip_vs.h
netfilter: move handlers to net/ip_vs.h
2021-02-04 18:37:57 -08:00
ip.h
inet: constify inet_sdif() argument
2020-11-10 17:56:54 -08:00
ipcomp.h
…
ipconfig.h
…
ipv6_frag.h
ipv6: Remove dependency of ipv6_frag_thdr_truncated on ipv6 module
2020-11-19 10:49:50 -08:00
ipv6_stubs.h
ipv6: add ipv6_fragment hook in ipv6_stub
2020-08-31 12:26:39 -07:00
ipv6.h
ipv6: Remove dependency of ipv6_frag_thdr_truncated on ipv6 module
2020-11-19 10:49:50 -08:00
ipx.h
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-05 14:28:09 +01:00
iw_handler.h
…
kcm.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
l3mdev.h
l3mdev: add infrastructure for table to VRF mapping
2020-06-20 17:22:22 -07:00
lag.h
…
lapb.h
net: lapb: Add locking to the lapb module
2021-01-26 17:53:45 -08:00
lib80211.h
…
llc_c_ac.h
…
llc_c_ev.h
…
llc_c_st.h
…
llc_conn.h
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
llc_if.h
…
llc_pdu.h
…
llc_s_ac.h
…
llc_s_ev.h
…
llc_s_st.h
…
llc_sap.h
…
llc.h
…
lwtunnel.h
net: add net available in build_state
2020-03-29 22:30:57 -07:00
mac80211.h
cfg80211: avoid holding the RTNL when calling the driver
2021-01-26 11:55:50 +01:00
mac802154.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
macsec.h
net: macsec: add support for getting offloaded stats
2020-03-26 20:17:36 -07:00
mip6.h
net: mip6: Replace zero-length array with flexible-array member
2020-03-02 11:16:27 -08:00
mld.h
net: ipv6: mld: Replace zero-length array with flexible-array member
2020-02-29 21:52:20 -08:00
mpls_iptunnel.h
net: mpls: Replace zero-length array with flexible-array member
2020-02-28 12:08:37 -08:00
mpls.h
net: Make mpls_entry_encode() available for generic users
2020-05-29 21:20:20 -07:00
mptcp.h
mptcp: add port support for ADD_ADDR suboption writing
2020-12-09 19:02:15 -08:00
mrp.h
treewide: Use sizeof_field() macro
2019-12-09 10:36:44 -08:00
ncsi.h
…
ndisc.h
ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype
2020-08-24 06:40:07 -07:00
neighbour.h
net: Exempt multicast addresses from five-second neighbor lifetime
2020-11-13 14:24:39 -08:00
net_failover.h
…
net_namespace.h
net: initialize net->net_cookie at netns setup
2021-02-11 14:10:07 -08:00
net_ratelimit.h
…
netevent.h
…
netlabel.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink.h
treewide: rename nla_strlcpy to nla_strscpy.
2020-11-16 08:08:54 -08:00
netprio_cgroup.h
netprio: use css ID instead of cgroup ID
2019-11-12 08:18:03 -08:00
netrom.h
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
nexthop.h
ipv6: fix suspecious RCU usage warning
2021-03-10 12:35:23 -08:00
nl802154.h
…
nsh.h
…
p8022.h
…
page_pool.h
net: page_pool: Add bulk support for ptr_ring
2020-11-14 02:29:00 +01:00
pie.h
pie: realign comment
2020-03-04 13:25:55 -08:00
ping.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
pkt_cls.h
sch_htb: Hierarchical QoS hardware offload
2021-01-22 20:41:29 -08:00
pkt_sched.h
net: sched: convert tasklets to use new tasklet_setup() API
2020-11-07 10:41:15 -08:00
pptp.h
…
protocol.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
psample.h
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
psnap.h
…
raw.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
rawv6.h
…
red.h
net: sched: validate stab values
2021-03-10 15:47:52 -08:00
regulatory.h
net/wireless: regulatory.h: drop duplicate word in comment
2020-07-31 09:24:23 +02:00
request_sock.h
tcp: bpf: Optionally store mac header in TCP_SAVE_SYN
2020-08-24 14:35:00 -07:00
rose.h
…
route.h
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
2020-11-23 18:36:21 -05:00
rpl.h
net: ipv6: Use struct_size() helper and kcalloc()
2020-06-23 20:27:09 -07:00
rsi_91x.h
…
rtnetlink.h
net: Add extack argument to rtnl_create_link
2018-11-06 15:00:45 -08:00
rtnh.h
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
sch_generic.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2021-02-02 14:21:31 -08:00
scm.h
fs: Move __scm_install_fd() to __receive_fd()
2020-07-13 11:03:44 -07:00
secure_seq.h
…
seg6_hmac.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
seg6_local.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
seg6.h
seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
2020-06-04 15:39:32 -07:00
slhc_vj.h
…
smc.h
net/smc: introduce CHID callback for ISM devices
2020-09-28 15:19:03 -07:00
snmp.h
net/tls: add skeleton of MIB statistics
2019-10-05 16:29:00 -07:00
sock_reuseport.h
net: sock_reuseport: Replace zero-length array with flexible-array member
2020-02-29 21:52:19 -08:00
sock.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2021-02-16 13:14:06 -08:00
Space.h
…
stp.h
…
strparser.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
switchdev.h
switchdev: mrp: Extend ring_role_mrp and in_role_mrp
2021-02-16 14:47:46 -08:00
tcp_states.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2021-02-16 13:14:06 -08:00
timewait_sock.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tipc.h
…
tls_toe.h
net/tls: rename tls_hw_* functions tls_toe_*
2019-10-04 14:07:07 -07:00
tls.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-11-27 18:25:27 -08:00
transp_v6.h
tcp: move ipv4_specific to tcp include file
2020-06-23 20:10:15 -07:00
tso.h
net: tso: cache transport header length
2020-06-18 20:46:23 -07:00
tun_proto.h
…
udp_tunnel.h
udp: call udp_encap_enable for v6 sockets when enabling encap
2021-02-04 18:37:14 -08:00
udp.h
ipv6: move udp declarations to net/udp.h
2021-02-04 18:37:57 -08:00
udplite.h
…
vsock_addr.h
vsock: remove include/linux/vm_sockets.h file
2019-11-14 18:12:17 -08:00
vxlan.h
net: sched: only keep the available bits when setting vxlan md->gbp
2020-09-14 16:49:39 -07:00
wext.h
…
x25.h
net/x25: add new state X25_STATE_5
2019-12-09 10:28:43 -08:00
x25device.h
…
xdp_priv.h
page_pool: do not release pool until inflight == 0.
2019-11-16 12:39:10 -08:00
xdp_sock_drv.h
xsk: Introduce batched Tx descriptor interfaces
2020-11-17 22:07:40 +01:00
xdp_sock.h
xsk: Fix race in SKB mode transmit with shared cq
2020-12-18 16:10:21 +01:00
xdp.h
net, veth: Alloc skb in bulk for ndo_xdp_xmit
2021-02-04 01:00:07 +01:00
xfrm.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-10-05 18:40:01 -07:00
xsk_buff_pool.h
xsk: Fix race in SKB mode transmit with shared cq
2020-12-18 16:10:21 +01:00