kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/sched
History
Toke Høiland-Jørgensen bb0245fa72 sched: sch_cake: add bounds checks to host bulk flow fairness counts 
commit 737d4d91d3 upstream.

Even though we fixed a logic error in the commit cited below, syzbot
still managed to trigger an underflow of the per-host bulk flow
counters, leading to an out of bounds memory access.

To avoid any such logic errors causing out of bounds memory accesses,
this commit factors out all accesses to the per-host bulk flow counters
to a series of helpers that perform bounds-checking before any
increments and decrements. This also has the benefit of improving
readability by moving the conditional checks for the flow mode into
these helpers, instead of having them spread out throughout the
code (which was the cause of the original logic error).

As part of this change, the flow quantum calculation is consolidated
into a helper function, which means that the dithering applied to the
ost load scaling is now applied both in the DRR rotation and when a
sparse flow's quantum is first initiated. The only user-visible effect
of this is that the maximum packet size that can be sent while a flow
stays sparse will now vary with +/- one byte in some cases. This should
not make a noticeable difference in practice, and thus it's not worth
complicating the code to preserve the old behaviour.

Fixes: 546ea84d07 ("sched: sch_cake: fix bulk flow accounting logic for host fairness")
Reported-by: syzbot+f63600d288bfb7057424@syzkaller.appspotmail.com
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Dave Taht <dave.taht@gmail.com>
Link: https://patch.msgid.link/20250107120105.70685-1-toke@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[Hagar: needed contextual fixes due to missing commit 7e3cf0843f]
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Reviewed-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-03-13 12:51:12 +01:00
..
act_api.c net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() 2024-07-05 09:14:30 +02:00
act_bpf.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_connmark.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_csum.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
act_ct.c sched: act_ct: take care of padding in struct zones_ht_key 2024-08-19 05:45:31 +02:00
act_ctinfo.c net/sched: act_ctinfo: use percpu stats 2023-02-22 12:57:10 +01:00
act_gact.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
act_gate.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_ife.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_ipt.c net/sched: act_ipt: add sanity checks on table name and hook locations 2023-07-23 13:47:28 +02:00
act_meta_mark.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbprio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_mirred.c net/sched: act_mirred: Add carrier check 2023-05-17 11:50:17 +02:00
act_mpls.c net/sched: act_mpls: fix action bind logic 2023-03-11 13:57:30 +01:00
act_nat.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_pedit.c net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX 2023-07-23 13:47:29 +02:00
act_police.c net: sched: act_police: fix sparse errors in tcf_police_dump() 2023-06-14 11:13:03 +02:00
act_sample.c net/sched: act_sample: fix action bind logic 2023-03-11 13:57:30 +01:00
act_simple.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_skbedit.c flow_offload: fill flags to action structure 2023-02-22 12:57:10 +01:00
act_skbmod.c net/sched: act_skbmod: prevent kernel-infoleak 2024-04-10 16:19:38 +02:00
act_tunnel_key.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
act_vlan.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_api.c net/sched: cls_api: Fix lockup on flushing explicitly created chain 2023-06-21 15:59:18 +02:00
cls_basic.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_bpf.c net: sched: cls_bpf: Undo tcf_bind_filter in case of an error 2023-07-27 08:47:00 +02:00
cls_cgroup.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_flow.c net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute 2025-01-23 17:15:49 +01:00
cls_flower.c net: extract port range fields from fl_flow_key 2025-03-13 12:50:52 +01:00
cls_fw.c net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 15:13:52 +02:00
cls_matchall.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_route.c net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 15:13:52 +02:00
cls_u32.c net: sched: cls_u32: Fix allocation size in u32_init() 2023-11-08 17:26:45 +01:00
em_canid.c net: sched: kerneldoc fixes 2020-07-13 17:20:40 -07:00
em_cmp.c net: sched: fix misspellings using misspell-fixer tool 2020-11-10 17:00:28 -08:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_meta.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_nbyte.c net: sched: Return the correct errno code 2021-02-06 11:15:28 -08:00
em_text.c net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-01-15 18:51:12 +01:00
em_u32.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-31 13:14:39 +01:00
Kconfig net/sched: Retire dsmark qdisc 2024-03-01 13:21:42 +01:00
Makefile net/sched: Retire dsmark qdisc 2024-03-01 13:21:42 +01:00
sch_api.c net: sched: Disallow replacing of child qdisc from one parent to another 2025-03-13 12:49:59 +01:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c sched: sch_cake: add bounds checks to host bulk flow fairness counts 2025-03-13 12:51:12 +01:00
sch_cbs.c net/sched: cbs: Fix integer overflow in cbs_set_port_rate() 2024-12-14 19:51:36 +01:00
sch_choke.c net: sched: fix ordering of qlen adjustment 2025-01-09 13:28:29 +01:00
sch_codel.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_drr.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_etf.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_ets.c net: sched: fix ets qdisc OOB Indexing 2025-02-01 18:24:00 +01:00
sch_fifo.c pfifo_tail_enqueue: Drop new packet when sch->limit == 0 2025-03-13 12:51:00 +01:00
sch_fq.c net/sched: sch_fq: fix integer overflow of "credit" 2023-05-11 23:00:31 +09:00
sch_fq_codel.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_fq_pie.c net/sched: fq_pie: avoid stalls in fq_pie_timer() 2023-09-19 12:22:58 +02:00
sch_frag.c net/sched: Extend qdisc control block with tc control block 2022-01-05 12:42:33 +01:00
sch_generic.c net/sched: fix netdevice reference leaks in attach_default_qdiscs() 2022-09-08 12:28:02 +02:00
sch_gred.c net: sched: Fix spelling mistakes 2021-05-31 22:44:56 -07:00
sch_hfsc.c net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve 2023-10-25 11:58:57 +02:00
sch_hhf.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_htb.c net: sched: sch: Fix off by one in htb_activate_prios() 2023-02-22 12:57:11 +01:00
sch_ingress.c net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs 2023-06-09 10:32:17 +02:00
sch_mq.c net: sched: update default qdisc visibility after Tx queue cnt changes 2021-11-18 19:16:10 +01:00
sch_mqprio.c net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 2023-08-03 10:22:36 +02:00
sch_multiq.c net: sched: sch_multiq: fix possible OOB write in multiq_tune() 2024-07-05 09:14:06 +02:00
sch_netem.c netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() 2025-03-13 12:50:23 +01:00
sch_pie.c net: sched: fix misspellings using misspell-fixer tool 2020-11-10 17:00:28 -08:00
sch_plug.c net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-19 12:22:59 +02:00
sch_prio.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_qfq.c net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-19 12:22:59 +02:00
sch_red.c net: sched: Fix use after free in red_enqueue() 2022-11-10 18:15:28 +01:00
sch_sfb.c net: sched: sfb: fix null pointer access issue when sfb_init() fails 2022-10-29 10:12:57 +02:00
sch_sfq.c net/sched: store the last executed chain also for clsact egress 2021-07-29 22:17:37 +01:00
sch_skbprio.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_taprio.c net: sched: fix use-after-free in taprio_change() 2024-11-01 01:52:37 +01:00
sch_tbf.c net/sched: tbf: correct backlog statistic for GSO packets 2024-12-14 19:51:27 +01:00
sch_teql.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00