]> git.baikalelectronics.ru Git - kernel.git/commit
fq_codel: reject silly quantum parameters
authorEric Dumazet <edumazet@google.com>
Fri, 3 Sep 2021 22:03:43 +0000 (15:03 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Sep 2021 10:26:45 +0000 (12:26 +0200)
commitb810a2e3d9c37a8fcb8dc428c7bbe9a95a6d0352
tree14ef4f91ee239be1ab77c3005e5926077b5c866b
parent5760dbfff6e05079b838dd68445401e76b08fada
fq_codel: reject silly quantum parameters

[ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ]

syzbot found that forcing a big quantum attribute would crash hosts fast,
essentially using this:

tc qd replace dev eth0 root fq_codel quantum 4294967295

This is because fq_codel_dequeue() would have to loop
~2^31 times in :

if (flow->deficit <= 0) {
flow->deficit += q->quantum;
list_move_tail(&flow->flowchain, &q->old_flows);
goto begin;
}

SFQ max quantum is 2^19 (half a megabyte)
Lets adopt a max quantum of one megabyte for FQ_CODEL.

Fixes: 87caad82cea4 ("fq_codel: Fair Queue Codel AQM")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
include/uapi/linux/pkt_sched.h
net/sched/sch_fq_codel.c