[PATCH net] sch_netem: fix a divide by zero in tabledist()

[PATCH net] sch_netem: fix a divide by zero in tabledist()

[Eric Dumazet]

syzbot managed to crash the kernel in tabledist() loading
an empty distribution table.

	t = dist->table[rnd % dist->size];

Simply return an error when such load is attempted.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 net/sched/sch_netem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index b17f2ed970e296adc57bed458ec3cced4fc6705b..f5cb35e550f8df557f2e444cc2fd142cab97789b 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -777,7 +777,7 @@ static int get_dist_table(struct Qdisc *sch, struct disttable **tbl,
 	struct disttable *d;
 	int i;
 
-	if (n > NETEM_DIST_MAX)
+	if (!n || n > NETEM_DIST_MAX)
 		return -EINVAL;
 
 	d = kvmalloc(sizeof(struct disttable) + n * sizeof(s16), GFP_KERNEL);
-- 
2.23.0.237.gc6a4ce50a0-goog

Re: [PATCH net] sch_netem: fix a divide by zero in tabledist()

[Jakub Kicinski]

On Wed, 18 Sep 2019 08:05:39 -0700, Eric Dumazet wrote:
> syzbot managed to crash the kernel in tabledist() loading
> an empty distribution table.
> 
> 	t = dist->table[rnd % dist->size];
> 
> Simply return an error when such load is attempted.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Applied, queued, thank you!

Re: [PATCH net] sch_netem: fix a divide by zero in tabledist()

[Eric Dumazet]

On 9/20/19 7:15 PM, Jakub Kicinski wrote:
> On Wed, 18 Sep 2019 08:05:39 -0700, Eric Dumazet wrote:
>> syzbot managed to crash the kernel in tabledist() loading
>> an empty distribution table.
>>
>> 	t = dist->table[rnd % dist->size];
>>
>> Simply return an error when such load is attempted.
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>> Reported-by: syzbot <syzkaller@googlegroups.com>
> 
> Applied, queued, thank you!
> 

Note that another divide by zero seems possible in the same function,
if sigma = 0x8000000


2*sigma becomes zero, and we have yet another issue in :

if (dist == NULL)
   return ((rnd % (2 * sigma)) + mu) - sigma;

Re: [PATCH net] sch_netem: fix a divide by zero in tabledist()

[Eric Dumazet]

On Mon, Sep 23, 2019 at 8:53 AM Eric Dumazet <eric.dumazet@gmail.com> wrote:
>
>
>
> On 9/20/19 7:15 PM, Jakub Kicinski wrote:
> > On Wed, 18 Sep 2019 08:05:39 -0700, Eric Dumazet wrote:
> >> syzbot managed to crash the kernel in tabledist() loading
> >> an empty distribution table.
> >>
> >>      t = dist->table[rnd % dist->size];
> >>
> >> Simply return an error when such load is attempted.
> >>
> >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> >> Signed-off-by: Eric Dumazet <edumazet@google.com>
> >> Reported-by: syzbot <syzkaller@googlegroups.com>
> >
> > Applied, queued, thank you!
> >
>
> Note that another divide by zero seems possible in the same function,
> if sigma = 0x8000000

I meant 0x80000000  here (aka 2^31 )

>
>
> 2*sigma becomes zero, and we have yet another issue in :
>
> if (dist == NULL)
>    return ((rnd % (2 * sigma)) + mu) - sigma;
>
>