Skip to content

Commit 839dd53

Browse files
committed
net/sched: taprio: make q->picos_per_byte available to fill_sched_entry()
jira LE-2015 cve CVE-2024-36244 Rebuild_History Non-Buildable kernel-5.14.0-427.42.1.el9_4 commit-author Vladimir Oltean <vladimir.oltean@nxp.com> commit e634134 In commit b5b73b2 ("taprio: Fix allowing too small intervals"), a comparison of user input against length_to_duration(q, ETH_ZLEN) was introduced, to avoid RCU stalls due to frequent hrtimers. The implementation of length_to_duration() depends on q->picos_per_byte being set for the link speed. The blamed commit in the Fixes: tag has moved this too late, so the checks introduced above are ineffective. The q->picos_per_byte is zero at parse_taprio_schedule() -> parse_sched_list() -> parse_sched_entry() -> fill_sched_entry() time. Move the taprio_set_picos_per_byte() call as one of the first things in taprio_change(), before the bulk of the netlink attribute parsing is done. That's because it is needed there. Add a selftest to make sure the issue doesn't get reintroduced. Fixes: 09dbdf2 ("net/sched: taprio: fix calculation of maximum gate durations") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20240527153955.553333-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit e634134) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent e061230 commit 839dd53

File tree

2 files changed

+25
-1
lines changed

2 files changed

+25
-1
lines changed

net/sched/sch_taprio.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1870,6 +1870,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
18701870

18711871
q->flags = err;
18721872

1873+
/* Needed for length_to_duration() during netlink attribute parsing */
1874+
taprio_set_picos_per_byte(dev, q);
1875+
18731876
err = taprio_parse_mqprio_opt(dev, mqprio, extack, q->flags);
18741877
if (err < 0)
18751878
return err;
@@ -1929,7 +1932,6 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
19291932
if (err < 0)
19301933
goto free_sched;
19311934

1932-
taprio_set_picos_per_byte(dev, q);
19331935
taprio_update_queue_max_sdu(q, new_admin, stab);
19341936

19351937
if (FULL_OFFLOAD_IS_ENABLED(q->flags))

tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,28 @@
132132
"echo \"1\" > /sys/bus/netdevsim/del_device"
133133
]
134134
},
135+
{
136+
"id": "6f62",
137+
"name": "Add taprio Qdisc with too short interval",
138+
"category": [
139+
"qdisc",
140+
"taprio"
141+
],
142+
"plugins": {
143+
"requires": "nsPlugin"
144+
},
145+
"setup": [
146+
"echo \"1 1 8\" > /sys/bus/netdevsim/new_device"
147+
],
148+
"cmdUnderTest": "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 queues 1@0 1@1 sched-entry S 01 300 sched-entry S 02 1700 clockid CLOCK_TAI",
149+
"expExitCode": "2",
150+
"verifyCmd": "$TC qdisc show dev $ETH",
151+
"matchPattern": "qdisc taprio 1: root refcnt",
152+
"matchCount": "0",
153+
"teardown": [
154+
"echo \"1\" > /sys/bus/netdevsim/del_device"
155+
]
156+
},
135157
{
136158
"id": "3e1e",
137159
"name": "Add taprio Qdisc with an invalid cycle-time",

0 commit comments

Comments
 (0)