• 王贇's avatar
    net: prevent user from passing illegal stab size · b193e15a
    王贇 authored
    We observed below report when playing with netlink sock:
    
      UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10
      shift exponent 249 is too large for 32-bit type
      CPU: 0 PID: 685 Comm: a.out Not tainted
      Call Trace:
       dump_stack_lvl+0x8d/0xcf
       ubsan_epilogue+0xa/0x4e
       __ubsan_handle_shift_out_of_bounds+0x161/0x182
       __qdisc_calculate_pkt_len+0xf0/0x190
       __dev_queue_xmit+0x2ed/0x15b0
    
    it seems like kernel won't check the stab log value passing from
    user, and will use the insane value later to calculate pkt_len.
    
    This patch just add a check on the size/cell_log to avoid insane
    calculation.
    Reported-by: default avatarAbaci <abaci@linux.alibaba.com>
    Signed-off-by: default avatarMichael Wang <yun.wang@linux.alibaba.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b193e15a
pkt_sched.h 5.01 KB