diff options
| author | Du Cheng <ducheng2@gmail.com> | 2021-04-17 02:30:46 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-19 11:12:57 +0300 |
| commit | d4b0dc31df991d347ff4be55db8e43f95ab75868 (patch) | |
| tree | af0414f87adcec3bb89e216129d93b59587dcfb0 /net/sched | |
| parent | 05916c62f54a9ae714beca5f97d28e8753b2782e (diff) | |
| download | linux-d4b0dc31df991d347ff4be55db8e43f95ab75868.tar.xz | |
net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
[ Upstream commit ed8157f1ebf1ae81a8fa2653e3f20d2076fad1c9 ]
There is a reproducible sequence from the userland that will trigger a WARN_ON()
condition in taprio_get_start_time, which causes kernel to panic if configured
as "panic_on_warn". Catch this condition in parse_taprio_schedule to
prevent this condition.
Reported as bug on syzkaller:
https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c
Reported-by: syzbot+d50710fd0873a9c6b40c@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/sch_taprio.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index c966c05a0be9..00853065dfa0 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -900,6 +900,12 @@ static int parse_taprio_schedule(struct taprio_sched *q, struct nlattr **tb, list_for_each_entry(entry, &new->entries, list) cycle = ktime_add_ns(cycle, entry->interval); + + if (!cycle) { + NL_SET_ERR_MSG(extack, "'cycle_time' can never be 0"); + return -EINVAL; + } + new->cycle_time = cycle; } |