• Randy Dunlap's avatar
    net: sched: prevent invalid Scell_log shift count · bd1248f1
    Randy Dunlap authored
    Check Scell_log shift size in red_check_params() and modify all callers
    of red_check_params() to pass Scell_log.
    
    This prevents a shift out-of-bounds as detected by UBSAN:
      UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22
      shift exponent 72 is too large for 32-bit type 'int'
    
    Fixes: 8afa10cb ("net_sched: red: Avoid illegal values")
    Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
    Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com
    Cc: Nogah Frankel <nogahf@mellanox.com>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Cc: netdev@vger.kernel.org
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    bd1248f1
sch_choke.c 12.5 KB