Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net/sched: taprio: extend minimum interval restriction to entire cycle too

It is possible for syzbot to side-step the restriction imposed by the
blamed commit in the Fixes: tag, because the taprio UAPI permits a
cycle-time different from (and potentially shorter than) the sum of
entry intervals.

We need one more restriction, which is that the cycle time itself must
be larger than N * ETH_ZLEN bit times, where N is the number of schedule
entries. This restriction needs to apply regardless of whether the cycle
time came from the user or was the implicit, auto-calculated value, so
we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)"
branch. This way covers both conditions and scenarios.

Add a selftest which illustrates the issue triggered by syzbot.

Fixes: b5b73b26b3ca ("taprio: Fix allowing too small intervals")
Reported-by: syzbot+a7d2b1d5d1af83035567@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/0000000000007d66bc06196e7c66@google.com/
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20240527153955.553333-2-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Vladimir Oltean and committed by
Jakub Kicinski
fb66df20 e6341341

+27 -5
+5 -5
net/sched/sch_taprio.c
··· 1151 1151 list_for_each_entry(entry, &new->entries, list) 1152 1152 cycle = ktime_add_ns(cycle, entry->interval); 1153 1153 1154 - if (!cycle) { 1155 - NL_SET_ERR_MSG(extack, "'cycle_time' can never be 0"); 1156 - return -EINVAL; 1157 - } 1158 - 1159 1154 if (cycle < 0 || cycle > INT_MAX) { 1160 1155 NL_SET_ERR_MSG(extack, "'cycle_time' is too big"); 1161 1156 return -EINVAL; 1162 1157 } 1163 1158 1164 1159 new->cycle_time = cycle; 1160 + } 1161 + 1162 + if (new->cycle_time < new->num_entries * length_to_duration(q, ETH_ZLEN)) { 1163 + NL_SET_ERR_MSG(extack, "'cycle_time' is too small"); 1164 + return -EINVAL; 1165 1165 } 1166 1166 1167 1167 taprio_calculate_gate_durations(q, new);
+22
tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json
··· 155 155 ] 156 156 }, 157 157 { 158 + "id": "831f", 159 + "name": "Add taprio Qdisc with too short cycle-time", 160 + "category": [ 161 + "qdisc", 162 + "taprio" 163 + ], 164 + "plugins": { 165 + "requires": "nsPlugin" 166 + }, 167 + "setup": [ 168 + "echo \"1 1 8\" > /sys/bus/netdevsim/new_device" 169 + ], 170 + "cmdUnderTest": "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 queues 1@0 1@1 sched-entry S 01 200000 sched-entry S 02 200000 cycle-time 100 clockid CLOCK_TAI", 171 + "expExitCode": "2", 172 + "verifyCmd": "$TC qdisc show dev $ETH", 173 + "matchPattern": "qdisc taprio 1: root refcnt", 174 + "matchCount": "0", 175 + "teardown": [ 176 + "echo \"1\" > /sys/bus/netdevsim/del_device" 177 + ] 178 + }, 179 + { 158 180 "id": "3e1e", 159 181 "name": "Add taprio Qdisc with an invalid cycle-time", 160 182 "category": [