diff options
| author | Eric Dumazet <[email protected]> | 2020-04-26 18:19:07 -0700 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2020-04-27 11:49:57 -0700 |
| commit | df4953e4e997e273501339f607b77953772e3559 (patch) | |
| tree | b6ebd6e34cfd0d4459e5f103f3b633f8cc1504f5 /lib/test-string_helpers.c | |
| parent | cf7fc3af87b2d767f55eeec9faeb4b45b929341c (diff) | |
sch_sfq: validate silly quantum values
syzbot managed to set up sfq so that q->scaled_quantum was zero,
triggering an infinite loop in sfq_dequeue()
More generally, we must only accept quantum between 1 and 2^18 - 7,
meaning scaled_quantum must be in [1, 0x7FFF] range.
Otherwise, we also could have a loop in sfq_dequeue()
if scaled_quantum happens to be 0x8000, since slot->allot
could indefinitely switch between 0 and 0x8000.
Fixes: eeaeb068f139 ("sch_sfq: allow big packets and be fair")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: [email protected]
Cc: Jason A. Donenfeld <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'lib/test-string_helpers.c')
0 files changed, 0 insertions, 0 deletions