sch_sfq: validate silly quantum values
[ Upstream commit df4953e4 ] syzbot managed to set up sfq so that q->scaled_quantum was zero, triggering an infinite loop in sfq_dequeue() More generally, we must only accept quantum between 1 and 2^18 - 7, meaning scaled_quantum must be in [1, 0x7FFF] range. Otherwise, we also could have a loop in sfq_dequeue() if scaled_quantum happens to be 0x8000, since slot->allot could indefinitely switch between 0 and 0x8000. Fixes: eeaeb068 ("sch_sfq: allow big packets and be fair") Signed-off-by:Eric Dumazet <edumazet@google.com> Reported-by:
<syzbot+0251e883fe39e7a0cb0a@syzkaller.appspotmail.com> Cc: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
9a67503a
Please register or sign in to comment