Eric Dumazet 3aa452bf9b sch_cbq: validate TCA_CBQ_WRROPT to avoid crash ... [ Upstream commit e9789c7cc182484fc031fd88097eb14cb26c4596 ] syzbot reported a crash in cbq_normalize_quanta() caused by an out of range cl->priority. iproute2 enforces this check, but malicious users do not. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN PTI Modules linked in: CPU: 1 PID: 26447 Comm: syz-executor.1 Not tainted 5.3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:cbq_normalize_quanta.part.0+0x1fd/0x430 net/sched/sch_cbq.c:902 RSP: 0018:ffff8801a5c333b0 EFLAGS: 00010206 RAX: 0000000020000003 RBX: 00000000fffffff8 RCX: ffffc9000712f000 RDX: 00000000000043bf RSI: ffffffff83be8962 RDI: 0000000100000018 RBP: ffff8801a5c33420 R08: 000000000000003a R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000002ef R13: ffff88018da95188 R14: dffffc0000000000 R15: 0000000000000015 FS: 00007f37d26b1700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004c7cec CR3: 00000001bcd0a006 CR4: 00000000001626f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffff83be9d57>] cbq_normalize_quanta include/net/pkt_sched.h:27 [inline] [<ffffffff83be9d57>] cbq_addprio net/sched/sch_cbq.c:1097 [inline] [<ffffffff83be9d57>] cbq_set_wrr+0x2d7/0x450 net/sched/sch_cbq.c:1115 [<ffffffff83bee8a7>] cbq_change_class+0x987/0x225b net/sched/sch_cbq.c:1537 [<ffffffff83b96985>] tc_ctl_tclass+0x555/0xcd0 net/sched/sch_api.c:2329 [<ffffffff83a84655>] rtnetlink_rcv_msg+0x485/0xc10 net/core/rtnetlink.c:5248 [<ffffffff83cadf0a>] netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2510 [<ffffffff83a7db6d>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5266 [<ffffffff83cac2c6>] netlink_unicast_kernel net/netlink/af_netlink.c:1324 [inline] [<ffffffff83cac2c6>] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1350 [<ffffffff83cacd4a>] netlink_sendmsg+0x89a/0xd50 net/netlink/af_netlink.c:1939 [<ffffffff8399d46e>] sock_sendmsg_nosec net/socket.c:673 [inline] [<ffffffff8399d46e>] sock_sendmsg+0x12e/0x170 net/socket.c:684 [<ffffffff8399f1fd>] ___sys_sendmsg+0x81d/0x960 net/socket.c:2359 [<ffffffff839a2d05>] __sys_sendmsg+0x105/0x1d0 net/socket.c:2397 [<ffffffff839a2df9>] SYSC_sendmsg net/socket.c:2406 [inline] [<ffffffff839a2df9>] SyS_sendmsg+0x29/0x30 net/socket.c:2404 [<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305 [<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-10-07 21:01:06 +02:00
..
6lowpan
9p	9p/virtio: Add cleanup path in p9_virtio_init	2019-08-04 09:34:51 +02:00
802
8021q	vlan: disable SIOCSHWTSTAMP in container	2019-05-16 19:45:17 +02:00
appletalk	appletalk: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
atm	net: atm: Fix potential Spectre v1 vulnerabilities	2019-04-27 09:33:59 +02:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
batman-adv	batman-adv: fix for leaked TVLV handler.	2019-08-04 09:34:39 +02:00
bluetooth	Revert "Bluetooth: validate BLE connection interval updates"	2019-10-05 12:27:36 +02:00
bridge	bridge/mdb: remove wrong use of NLM_F_MULTI	2019-09-21 07:12:37 +02:00
caif
can	can: purge socket error queue on sock destruct	2019-07-10 09:56:33 +02:00
ceph	libceph: handle an empty authorize reply	2019-03-23 08:44:18 +01:00
core	net: Fix null de-reference of device refcount	2019-09-21 07:12:39 +02:00
dcb
dccp	dccp: do not use ipv6 header for ipv4 flow	2019-04-03 06:23:25 +02:00
decnet
dns_resolver
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-20 10:13:15 +01:00
ethernet
hsr	net/hsr: fix possible crash in add_timer()	2019-03-23 08:44:31 +01:00
ieee802154	ieee802154: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
ipv4	net: ipv4: avoid mixed n_redirects and rate_tokens usage	2019-10-07 21:01:04 +02:00
ipv6	ipv6: drop incoming packets having a v4mapped source address	2019-10-07 21:01:04 +02:00
ipx
irda
iucv
key	xfrm: clean up xfrm protocol checks	2019-09-16 08:13:35 +02:00
l2tp	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-11 12:20:46 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:18:25 +02:00
llc	llc: fix skb leak in llc_build_and_send_ui_pkt()	2019-06-11 12:24:06 +02:00
mac80211	mac80211: handle deauthentication/disassociation from TDLS peer	2019-10-05 12:27:39 +02:00
mac802154
mpls
netfilter	netfilter: nf_conntrack_ftp: Fix debug output	2019-09-21 07:12:51 +02:00
netlabel
netlink
netrom	netrom: hold sock when setting skb->destructor	2019-08-04 09:34:54 +02:00
nfc	nfc: fix memory leak in llcp_sock_bind()	2019-10-07 21:01:05 +02:00
openvswitch	openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC	2019-10-05 12:27:41 +02:00
packet	af_packet: tone down the Tx-ring unsupported spew.	2019-09-16 08:13:36 +02:00
phonet	phonet: fix building with clang	2019-03-23 08:44:34 +01:00
rds	net/rds: Fix error handling in rds_ib_add_one()	2019-10-07 21:01:06 +02:00
rfkill
rose	net: rose: fix a possible stack overflow	2019-04-03 06:23:25 +02:00
rxrpc
sched	sch_cbq: validate TCA_CBQ_WRROPT to avoid crash	2019-10-07 21:01:06 +02:00
sctp	sctp: use transport pf_retrans in sctp_do_8_2_transport_strike	2019-09-21 07:12:40 +02:00
sunrpc	sunrpc: don't mark uninitialised items as VALID.	2019-05-16 19:44:44 +02:00
switchdev
tipc	tipc: add NULL pointer check before calling kfree_rcu	2019-09-21 07:12:41 +02:00
unix	missing barriers in some of unix_sock ->addr and ->path accesses	2019-03-23 08:44:31 +01:00
vmw_vsock	vsock: cope with memory allocation failure at socket creation time	2019-02-23 09:05:13 +01:00
wimax
wireless	cfg80211: Purge frame registrations on iftype change	2019-10-05 12:27:54 +02:00
x25	net/x25: fix a race in x25_bind()	2019-03-23 08:44:30 +01:00
xfrm	xfrm: clean up xfrm protocol checks	2019-09-16 08:13:35 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-13 10:05:28 +01:00
Kconfig
Makefile
socket.c	sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names	2019-03-23 08:44:21 +01:00
sysctl_net.c