Eric Dumazet df4646250f net_sched: reject silly cell_log in qdisc_get_rtab() ... commit e4bedf48aa upstream. iproute2 probably never goes beyond 8 for the cell exponent, but stick to the max shift exponent for signed 32bit. UBSAN reported: UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22 shift exponent 130 is too large for 32-bit type 'int' CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389 qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435 cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180 qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246 tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662 rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564 netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345 ___sys_sendmsg net/socket.c:2399 [inline] __sys_sendmsg+0x319/0x400 net/socket.c:2432 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Cong Wang <cong.wang@bytedance.com> Link: https://lore.kernel.org/r/20210114160637.1660597-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-27 11:05:43 +01:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-11-05 11:08:44 +01:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:04:19 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-13 08:52:59 +01:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:14:43 +02:00
ax25	AX.25: Prevent integer overflows in connect and sendmsg	2020-07-31 18:37:48 +02:00
batman-adv	batman-adv: set .owner to THIS_MODULE	2020-12-02 08:48:10 +01:00
bluetooth	Bluetooth: Fix null pointer dereference in hci_event_packet()	2020-12-30 11:25:52 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	net: bridge: vlan: fix error return code in __vlan_add()	2020-12-30 11:25:41 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: af_can: prevent potential access of uninitialized member in canfd_rcv()	2020-11-24 13:27:22 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:08:53 +01:00
core	skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too	2021-01-27 11:05:42 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 15:49:56 +01:00
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-04-29 16:31:16 +02:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:13:37 +01:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:30:24 +02:00
dsa	net: dsa: read mac address from DT for slave device	2020-11-10 12:36:02 +01:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:19:09 +01:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-21 09:03:03 +02:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-18 07:14:15 +01:00
ife
ipv4	udp: mask TOS bits in udp_v4_early_demux()	2021-01-27 11:05:43 +01:00
ipv6	ipv6: create multicast route with RTPROT_KERNEL	2021-01-27 11:05:43 +01:00
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-12-08 10:18:52 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: pfkey_dump needs parameter validation	2020-09-26 18:01:28 +02:00
l2tp	l2tp: remove skb_dst_set() from l2tp_xmit_skb()	2020-07-22 09:31:59 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	net: silence data-races on sk_backlog.tail	2020-10-01 13:14:26 +02:00
mac80211	mac80211: don't set set TDLS STA bandwidth wider than possible	2020-12-30 11:26:03 +01:00
mac802154	mac802154: tx: fix use-after-free	2020-10-01 13:14:51 +02:00
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-04-29 16:31:17 +02:00
ncsi	net/ncsi: Use real net-device for response handler	2021-01-12 20:10:18 +01:00
netfilter	netfilter: nf_nat: Fix memleak in nf_nat_init	2021-01-19 18:22:38 +01:00
netlabel	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()	2020-11-24 13:27:17 +01:00
netlink	genetlink: remove genl_bind	2020-07-22 09:31:58 +02:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-04-29 16:31:21 +02:00
nfc	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()	2020-10-29 09:54:58 +01:00
nsh
openvswitch	openvswitch: handle DNAT tuple collision	2020-10-14 10:31:24 +02:00
packet	net/packet: fix overflow in tpacket_rcv	2020-10-07 08:00:08 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 09:21:30 +01:00
qrtr	net: qrtr: check skb_put_padto() return value	2020-09-26 18:01:30 +02:00
rds	rds: Prevent kernel-infoleak in rds_notify_queue_get()	2020-08-05 10:06:01 +02:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:17:17 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-12-08 10:18:52 +01:00
rxrpc	rxrpc: Fix handling of an unsupported token type in rxrpc_read()	2021-01-23 15:49:56 +01:00
sched	net_sched: reject silly cell_log in qdisc_get_rtab()	2021-01-27 11:05:43 +01:00
sctp	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:27:18 +01:00
smc	net/smc: fix valid DMBE buffer sizes	2020-10-29 09:54:55 +01:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	net: sunrpc: interpret the return value of kstrtou32 correctly	2021-01-19 18:22:38 +01:00
switchdev
tipc	tipc: fix NULL deref in tipc_link_xmit()	2021-01-23 15:49:56 +01:00
tls	net/tls: Protect from calling tls_dev_del for TLS RX twice	2020-12-08 10:18:52 +01:00
unix	skbuff: fix a data race in skb_queue_len()	2020-10-01 13:14:32 +02:00
vmw_vsock	vsock: use ns_capable_noaudit() on socket create	2020-11-10 12:35:59 +01:00
wimax
wireless	cfg80211: initialize rekey_data	2020-12-30 11:26:06 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-08 10:18:54 +01:00
xdp	xsk: Fix xsk_poll()'s return type	2020-12-30 11:25:44 +01:00
xfrm	net: xfrm: fix a race condition during allocing spi	2020-11-18 19:18:41 +01:00
compat.c	net/compat: Add missing sock updates for SCM_RIGHTS	2020-08-21 11:05:32 +02:00
Kconfig
Makefile
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-19 08:15:03 +02:00
sysctl_net.c