From patchwork Fri Jul 7 21:59:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pedro Tammela X-Patchwork-Id: 13305379 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C21217AC8 for ; Fri, 7 Jul 2023 22:01:26 +0000 (UTC) Received: from mail-ot1-x32b.google.com (mail-ot1-x32b.google.com [IPv6:2607:f8b0:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BB6AB7 for ; Fri, 7 Jul 2023 15:01:25 -0700 (PDT) Received: by mail-ot1-x32b.google.com with SMTP id 46e09a7af769-6b886456f66so1939748a34.0 for ; Fri, 07 Jul 2023 15:01:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20221208.gappssmtp.com; s=20221208; t=1688767284; x=1691359284; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=nBSshbMiCUOyTKW3WH8bAnlcnqbOyyGEgz8YI7SdsNg=; b=5oXCqWVlR/ZwOkFqorpzCf/F5nIl8WEVvk1iXVA/yKkivb+9oLW53y7hHoAyC0RjoN DOoH2TxsgPjm62GbAgtfSRkgKmOofSTvXGYHQivUp5wW58M4WKH2fjbXMa5GBlTgaeG1 D8kWJk40ERyUMaafLtpTIwtZ8KunrKyYbkSgeRW/srxao7x8Ur40yjGhBIYZuKUyPXo6 qxraNdgWX6E5kQSZUiOHNZHEr7UwLTWoPK925bs4/K+K948shPPOBdK0GF18Tw61rZ0T A4nhPFrxxjDNlBVQ39nB3nbStIqiovRISkNrRSnhhgMN30I8m6Gl6Tqf2vE/+743Hx4J vHAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688767284; x=1691359284; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=nBSshbMiCUOyTKW3WH8bAnlcnqbOyyGEgz8YI7SdsNg=; b=YacbmIuCLXfZFSjTh7KxZaetQPP5IiYfTWTE8gSZ1sOMFTPZGM3h4q7MPvxW4v9C4U aj+pIuoKpeojdfj/MnySeLHTY0jYyTIO74w5ZYZ4YwGLKKCRXhwwPOIWTIG7z5qKRnOJ xWKJT9iiUwtvFC9zxx9I7/KGm5SvpGIcBuPlBNiccchRhnjlLSWTFi0Om1JiICCDvcVb lbZe+PJ3Mj/yr4cDOi1Uff9hY5sZQQ8QHL3Ogx0x2MJRbtUX6ItQfc+H6bpDsppDt+gq 7MLM9NQs6F137UpmEmXIvogu7v0/ZZsvnzpNAsl6HWZukU/JcOEzHf+ZIx94biD+ceQo lWQg== X-Gm-Message-State: ABy/qLaBkkD4qrXljsoHcmpuefQdp9bVelaOBO9LMGFPMgaoq/AVanFJ M1y6Pl44ZIIBZjPYquT1WI84EfDZuIHGUXCO/zw= X-Google-Smtp-Source: APBJJlG5xzqOKaVuPpZ29eMTBKsy6e0XuyA2TReqewuLynsOj5SINQVDHmCEEUIYyC68ZgwByfVasg== X-Received: by 2002:a05:6830:1114:b0:6b7:49e1:f8f2 with SMTP id w20-20020a056830111400b006b749e1f8f2mr6281599otq.20.1688767284009; Fri, 07 Jul 2023 15:01:24 -0700 (PDT) Received: from rogue-one.tail33bf8.ts.net ([2804:14d:5c5e:44fb:9dd1:feea:c9a4:7223]) by smtp.gmail.com with ESMTPSA id p9-20020a9d76c9000000b006b45be2fdc2sm2055533otl.65.2023.07.07.15.01.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Jul 2023 15:01:23 -0700 (PDT) From: Pedro Tammela To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, shaozhengchao@huawei.com, victor@mojatatu.com, simon.horman@corigine.com, paolo.valente@unimore.it, Pedro Tammela Subject: [PATCH net v2 1/4] net/sched: sch_qfq: reintroduce lmax bound check for MTU Date: Fri, 7 Jul 2023 18:59:57 -0300 Message-Id: <20230707220000.461410-2-pctammela@mojatatu.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230707220000.461410-1-pctammela@mojatatu.com> References: <20230707220000.461410-1-pctammela@mojatatu.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: kuba@kernel.org 25369891fcef deletes a check for the case where no 'lmax' is specified which 3037933448f6 previously fixed as 'lmax' could be set to the device's MTU without any bound checking for QFQ_LMAX_MIN and QFQ_LMAX_MAX. Therefore, reintroduce the check. Fixes: 25369891fcef ("net/sched: sch_qfq: refactor parsing of netlink parameters") Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Eric Dumazet --- net/sched/sch_qfq.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index dfd9a99e6257..63a5b277c117 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -423,10 +423,17 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, else weight = 1; - if (tb[TCA_QFQ_LMAX]) + if (tb[TCA_QFQ_LMAX]) { lmax = nla_get_u32(tb[TCA_QFQ_LMAX]); - else + } else { + /* MTU size is user controlled */ lmax = psched_mtu(qdisc_dev(sch)); + if (lmax < QFQ_MIN_LMAX || lmax > QFQ_MAX_LMAX) { + NL_SET_ERR_MSG_MOD(extack, + "MTU size out of bounds for qfq"); + return -EINVAL; + } + } inv_w = ONE_FP / weight; weight = ONE_FP / inv_w; From patchwork Fri Jul 7 21:59:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pedro Tammela X-Patchwork-Id: 13305380 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37AEB17FE4 for ; Fri, 7 Jul 2023 22:01:29 +0000 (UTC) Received: from mail-ot1-x32b.google.com (mail-ot1-x32b.google.com [IPv6:2607:f8b0:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F37CBB7 for ; Fri, 7 Jul 2023 15:01:28 -0700 (PDT) Received: by mail-ot1-x32b.google.com with SMTP id 46e09a7af769-6b73c2b6dcfso1919077a34.2 for ; Fri, 07 Jul 2023 15:01:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20221208.gappssmtp.com; s=20221208; t=1688767288; x=1691359288; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JMIZsHa3uwMa+8crvw6UUPjFIn6xo4rxqJ9Ra4LvEew=; b=KYLAAhr1eXMMAxZt45HPy+O4nWNB2iqa4EJakiB6yxWai5puFyqupfTPXfOjx0gs3o l3gWIK4iTknH63QL/TeWCj0rUUyF+63Y9zWF4iR7Vqr+5jJK/NlaAozNgMwtVhcOtfW+ buyCIvwARFlQW6hoLeiVHZnFPWditkcgSBDijx7hiWAUc7MM5G6zyjR9QfS0NhMje1i0 2AYCcneveBUNmsZD4qYIYpBH+bo6dnxHry6y+3pvl650BBgiiq3x7LeFweVty13mHA1C FaKZd+N4mkhAAYbVMcAXb1tI2j8f3pQwWqWMbN7RK+mhXOPGuy5LCqzDP80t9f2AU87i cyoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688767288; x=1691359288; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JMIZsHa3uwMa+8crvw6UUPjFIn6xo4rxqJ9Ra4LvEew=; b=SfsOfVmzHsR+XI8jcm+t25m9b8nGnnhGswri+DIzt4+avUJRxCnPraBJsU8lWrFnGr GDd4U3jWAjWnviJUNAX0imW+PKwR2K+5jszraPybcmEgB7qxfRaGSFatRR8YAJbQTJa5 xgo3lSXh2mwELxdGwTf2zUBSRh/hHFLOi2hOUHk1LPN1M6I6H7CnTFGsOIqoyj8Pwvet rF37vFv+Ll4gWawSHp70T90KtgpaRHaqftW7lUofZPjAgm2OlNoS+/DgrmflU9HFR0tM BehsjxBI40UvGj1O+zUj1Pgim2kbvyh7U5J0yzqjLfChuN9NI7MFisOuwXV1NNEMRHK1 3HVg== X-Gm-Message-State: ABy/qLbH9MRS+yAhP1ixfX7CwBrZx4kpSQsgr82w1fOj+fBcYwQnmHBh UcCcYNt1njBX0pS+6ROIyTdXV6pdOMyxwVdJLVg= X-Google-Smtp-Source: APBJJlELgLA+foXY/WKoAqLnXWSITLlRHiNz2ovIAVkmx46rS0/phC40G9eBIw9d0hu7EYoyN2tngQ== X-Received: by 2002:a9d:7d82:0:b0:6b8:68ac:f7f1 with SMTP id j2-20020a9d7d82000000b006b868acf7f1mr5275832otn.8.1688767288203; Fri, 07 Jul 2023 15:01:28 -0700 (PDT) Received: from rogue-one.tail33bf8.ts.net ([2804:14d:5c5e:44fb:9dd1:feea:c9a4:7223]) by smtp.gmail.com with ESMTPSA id p9-20020a9d76c9000000b006b45be2fdc2sm2055533otl.65.2023.07.07.15.01.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Jul 2023 15:01:28 -0700 (PDT) From: Pedro Tammela To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, shaozhengchao@huawei.com, victor@mojatatu.com, simon.horman@corigine.com, paolo.valente@unimore.it, Pedro Tammela Subject: [PATCH net v2 2/4] selftests: tc-testing: add tests for qfq mtu sanity check Date: Fri, 7 Jul 2023 18:59:58 -0300 Message-Id: <20230707220000.461410-3-pctammela@mojatatu.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230707220000.461410-1-pctammela@mojatatu.com> References: <20230707220000.461410-1-pctammela@mojatatu.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: kuba@kernel.org QFQ only supports a certain bound of MTU size so make sure we check for this requirement in the tests. Tested-by: Zhengchao Shao Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela --- .../tc-testing/tc-tests/qdiscs/qfq.json | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json index 147899a868d3..965da7622dac 100644 --- a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json +++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json @@ -213,5 +213,53 @@ "$TC qdisc del dev $DUMMY handle 1: root", "$IP link del dev $DUMMY type dummy" ] + }, + { + "id": "85ee", + "name": "QFQ with big MTU", + "category": [ + "qdisc", + "qfq" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$IP link add dev $DUMMY type dummy || /bin/true", + "$IP link set dev $DUMMY mtu 2147483647 || /bin/true", + "$TC qdisc add dev $DUMMY handle 1: root qfq" + ], + "cmdUnderTest": "$TC class add dev $DUMMY parent 1: classid 1:1 qfq weight 100", + "expExitCode": "2", + "verifyCmd": "$TC class show dev $DUMMY", + "matchPattern": "class qfq 1:", + "matchCount": "0", + "teardown": [ + "$IP link del dev $DUMMY type dummy" + ] + }, + { + "id": "ddfa", + "name": "QFQ with small MTU", + "category": [ + "qdisc", + "qfq" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$IP link add dev $DUMMY type dummy || /bin/true", + "$IP link set dev $DUMMY mtu 256 || /bin/true", + "$TC qdisc add dev $DUMMY handle 1: root qfq" + ], + "cmdUnderTest": "$TC class add dev $DUMMY parent 1: classid 1:1 qfq weight 100", + "expExitCode": "2", + "verifyCmd": "$TC class show dev $DUMMY", + "matchPattern": "class qfq 1:", + "matchCount": "0", + "teardown": [ + "$IP link del dev $DUMMY type dummy" + ] } ] From patchwork Fri Jul 7 21:59:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pedro Tammela X-Patchwork-Id: 13305381 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51036C2CF for ; Fri, 7 Jul 2023 22:01:34 +0000 (UTC) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37BBFB7 for ; Fri, 7 Jul 2023 15:01:33 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id 46e09a7af769-6b72c4038b6so2219679a34.0 for ; Fri, 07 Jul 2023 15:01:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20221208.gappssmtp.com; s=20221208; t=1688767292; x=1691359292; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=QXw668lhVjY+nVyco9iMBAc5I6s5jIufQ48UxaWrmLY=; b=bhk2aT6a1/9LbHmkIGABaaG3464OnL6FGE2RcCvHKJE0/0Smz35iyuINW5aaWhq1XU 8joz4ss5QJXEnFp/oG+xlYcHJf6KjSQmlPB0vb/2Srgfy1pVvQjqnWONT094/O0SD+jA ifGAPZXYDH3wAIzli6IiDGAAgC2UICptCT4Odwq+EZoEPTJ7YLxK/diE5ZQE0Lazvh+5 RWPIkE1QFriAsK3K6b2hKpNSEk8eUOExvd4OonbRdeuszw3f3yDnUE6V/cdPHfP07y/2 qZnx4o2gWGHJvIazqdSeNRSDWKOvHzuOmd9bvqJfXfSL4/rhNSh1A/npusBS2nsEP2O8 kk3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688767292; x=1691359292; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=QXw668lhVjY+nVyco9iMBAc5I6s5jIufQ48UxaWrmLY=; b=jcTv8jmtDMlBKbxHzwrtfz9wEbA44ZTVrs9qoY2BWzLbqaAzN1J92LviiYq6obAuX9 nU9H0W7slpUFd9bZe+H/0C32TyCCZAVfx3TQAs3aF9ayXmrhYnRUnL1TBOGSfqa6F4vy xyFOB7kvzmtBEfp70Jnpv1VAxQIDGYUY/y08gUBgodh5fDupkQyjZuknwNhvhIhJQrTM ZRSozvbrG2mcdJcR/qicLRhgp2B6623aD/dbegJVpTREkUR99LcyQ4F8lLzedZv/KBgR Kk+lGZL+9Qme6mddy/ejuF7XmNFJVPp00Y+2RVe5xlOnQ46HxVB7CEYpNipqykx7yWz4 bBLA== X-Gm-Message-State: ABy/qLZJPq0Dl8AeYxsBCO+3w8To2jIoT/3FREh3PZVj8sj4zt8xBB5J AY8VZQByp24FOFSdsZ8tN5ciLg7D9xfwVQKcaKQ= X-Google-Smtp-Source: APBJJlHhjy6w8B94WHluJxwprN/SeCxzAIDNOgsNEX3xB8/3ySQqaPm3CAqOXu+scUCUxf6JkH3OEw== X-Received: by 2002:a05:6830:1e72:b0:6b7:9a33:8580 with SMTP id m18-20020a0568301e7200b006b79a338580mr6585128otr.30.1688767292346; Fri, 07 Jul 2023 15:01:32 -0700 (PDT) Received: from rogue-one.tail33bf8.ts.net ([2804:14d:5c5e:44fb:9dd1:feea:c9a4:7223]) by smtp.gmail.com with ESMTPSA id p9-20020a9d76c9000000b006b45be2fdc2sm2055533otl.65.2023.07.07.15.01.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Jul 2023 15:01:32 -0700 (PDT) From: Pedro Tammela To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, shaozhengchao@huawei.com, victor@mojatatu.com, simon.horman@corigine.com, paolo.valente@unimore.it, Pedro Tammela , Lion Subject: [PATCH net v2 3/4] net/sched: sch_qfq: account for stab overhead in qfq_enqueue Date: Fri, 7 Jul 2023 18:59:59 -0300 Message-Id: <20230707220000.461410-4-pctammela@mojatatu.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230707220000.461410-1-pctammela@mojatatu.com> References: <20230707220000.461410-1-pctammela@mojatatu.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: kuba@kernel.org Lion says: ------- In the QFQ scheduler a similar issue to CVE-2023-31436 persists. Consider the following code in net/sched/sch_qfq.c: static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { unsigned int len = qdisc_pkt_len(skb), gso_segs; // ... if (unlikely(cl->agg->lmax < len)) { pr_debug("qfq: increasing maxpkt from %u to %u for class %u", cl->agg->lmax, len, cl->common.classid); err = qfq_change_agg(sch, cl, cl->agg->class_weight, len); if (err) { cl->qstats.drops++; return qdisc_drop(skb, sch, to_free); } // ... } Similarly to CVE-2023-31436, "lmax" is increased without any bounds checks according to the packet length "len". Usually this would not impose a problem because packet sizes are naturally limited. This is however not the actual packet length, rather the "qdisc_pkt_len(skb)" which might apply size transformations according to "struct qdisc_size_table" as created by "qdisc_get_stab()" in net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc. A user may choose virtually any size using such a table. As a result the same issue as in CVE-2023-31436 can occur, allowing heap out-of-bounds read / writes in the kmalloc-8192 cache. ------- We can create the issue with the following commands: tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \ overhead 999999999 linklayer ethernet qfq tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k tc filter add dev $DEV parent 1: matchall classid 1:1 ping -I $DEV 1.1.1.2 This is caused by incorrectly assuming that qdisc_pkt_len() returns a length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: Lion Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Eric Dumazet --- net/sched/sch_qfq.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 63a5b277c117..befaf74b33ca 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -381,8 +381,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight, u32 lmax) { struct qfq_sched *q = qdisc_priv(sch); - struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight); + struct qfq_aggregate *new_agg; + /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */ + if (lmax > QFQ_MAX_LMAX) + return -EINVAL; + + new_agg = qfq_find_agg(q, lmax, weight); if (new_agg == NULL) { /* create new aggregate */ new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC); if (new_agg == NULL) From patchwork Fri Jul 7 22:00:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pedro Tammela X-Patchwork-Id: 13305382 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3E3317FFA for ; Fri, 7 Jul 2023 22:01:38 +0000 (UTC) Received: from mail-ot1-x336.google.com (mail-ot1-x336.google.com [IPv6:2607:f8b0:4864:20::336]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 17693B7 for ; Fri, 7 Jul 2023 15:01:37 -0700 (PDT) Received: by mail-ot1-x336.google.com with SMTP id 46e09a7af769-6b74faaac3bso2201909a34.1 for ; Fri, 07 Jul 2023 15:01:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20221208.gappssmtp.com; s=20221208; t=1688767296; x=1691359296; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=8eAqcjmCaVw9XN/waU4BooIl/PL/BIW2zs3IRQnhOZg=; b=fjiA95ATIsTC437w54ApXAR9NfwJeIrLdrurK/xxTJv/nF7+h7JUR3NnxmSd4VITDI 2TgzG0nTE+5kOVqNIy0x4Cnnw/3kIa7IRyhG4ia60sqip418mx79UocISymdBILcuazz HNeYV+QzdN62wksvDiLpuAoaheM6MTCTvdfrkfIwTDSsUYiXYxRmjNT+FAvkqseOOXsX xKAlN5XNAFXB2AJssm+yQbOT44nXTkNUui97gfA90netNVFx4g3EZGYTB/66TTDgDHCN GcKTrnmVJsoTkvSkMbYJra4vSs8qKRZzmMjznl+wrM/ebx6QnW8MkASmSZ3/xTrFooiz +KDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688767296; x=1691359296; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=8eAqcjmCaVw9XN/waU4BooIl/PL/BIW2zs3IRQnhOZg=; b=G26qH+BxLF6STs4uwAm6kTYcn+eoSBWMmLdjgs46gIEtfuinc6Ouli3W4CLaGtKYgW VcjRvbIgJRCRkYUVP6lKfwda7BWW9xTUhiOgIAYZBYOdGC6zKBkgEMkk/j5/fDmpPrUQ Q/RYmTc/mMs76LG/LWOZjquA+mLlBd3Q2wJwJ+prZvJZ0QASNzNENv2lzb7VjAerb7EY 3vsrQij33klWc9gNLfxNLUTvzFsxAbPfBX505pvdhfP/eeOrwoN0BNXZm8hvjEJe5uEE 8JDZHdOWDxtBRjoEF49LYF/O7eHwrd4x421yVfbhli3HRNHTTHVYZI3X4B4YAxUvDnb/ BH4w== X-Gm-Message-State: ABy/qLYsVmJm2DlgYYirS90rp3sg5jj+zAEUBl6/pnniyd1VwHXEQcY0 vS3lx2LT2DmuSdRCZc6oAAATCI+1e+AiH6kQRoY= X-Google-Smtp-Source: APBJJlEf7YGhRSAxZZ9ab8n8jSD6EURLpHV4bNF8YVXfuVIDYMxj9ZFMc/50wH8TsohrlxM55uVzYg== X-Received: by 2002:a9d:4f16:0:b0:6b8:8006:df83 with SMTP id d22-20020a9d4f16000000b006b88006df83mr6180679otl.17.1688767296327; Fri, 07 Jul 2023 15:01:36 -0700 (PDT) Received: from rogue-one.tail33bf8.ts.net ([2804:14d:5c5e:44fb:9dd1:feea:c9a4:7223]) by smtp.gmail.com with ESMTPSA id p9-20020a9d76c9000000b006b45be2fdc2sm2055533otl.65.2023.07.07.15.01.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Jul 2023 15:01:36 -0700 (PDT) From: Pedro Tammela To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, shuah@kernel.org, shaozhengchao@huawei.com, victor@mojatatu.com, simon.horman@corigine.com, paolo.valente@unimore.it, Pedro Tammela Subject: [PATCH net v2 4/4] selftests: tc-testing: add test for qfq with stab overhead Date: Fri, 7 Jul 2023 19:00:00 -0300 Message-Id: <20230707220000.461410-5-pctammela@mojatatu.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230707220000.461410-1-pctammela@mojatatu.com> References: <20230707220000.461410-1-pctammela@mojatatu.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: kuba@kernel.org A packet with stab overhead greater than QFQ_MAX_LMAX should be dropped by the QFQ qdisc as it can't handle such lengths. Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela --- .../tc-testing/tc-tests/qdiscs/qfq.json | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json index 965da7622dac..6b8798f8dd04 100644 --- a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json +++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/qfq.json @@ -261,5 +261,43 @@ "teardown": [ "$IP link del dev $DUMMY type dummy" ] + }, + { + "id": "5993", + "name": "QFQ with stab overhead greater than max packet len", + "category": [ + "qdisc", + "qfq", + "scapy" + ], + "plugins": { + "requires": [ + "nsPlugin", + "scapyPlugin" + ] + }, + "setup": [ + "$IP link add dev $DUMMY type dummy || /bin/true", + "$IP link set dev $DUMMY up || /bin/true", + "$TC qdisc add dev $DUMMY handle 1: stab mtu 2048 tsize 512 mpu 0 overhead 999999999 linklayer ethernet root qfq", + "$TC class add dev $DUMMY parent 1: classid 1:1 qfq weight 100", + "$TC qdisc add dev $DEV1 clsact", + "$TC filter add dev $DEV1 ingress matchall action mirred egress mirror dev $DUMMY" + ], + "cmdUnderTest": "$TC filter add dev $DUMMY parent 1: matchall classid 1:1", + "scapy": [ + { + "iface": "$DEV0", + "count": 22, + "packet": "Ether(type=0x800)/IP(src='10.0.0.10',dst='10.0.0.10')/TCP(sport=5000,dport=10)" + } + ], + "expExitCode": "0", + "verifyCmd": "$TC -s qdisc ls dev $DUMMY", + "matchPattern": "dropped 22", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DUMMY handle 1: root qfq" + ] } ]