| From foo@baz Tue 01 Oct 2019 04:21:39 PM CEST |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Wed, 18 Sep 2019 08:05:39 -0700 |
| Subject: sch_netem: fix a divide by zero in tabledist() |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit b41d936b5ecfdb3a4abc525ce6402a6c49cffddc ] |
| |
| syzbot managed to crash the kernel in tabledist() loading |
| an empty distribution table. |
| |
| t = dist->table[rnd % dist->size]; |
| |
| Simply return an error when such load is attempted. |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/sched/sch_netem.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/sched/sch_netem.c |
| +++ b/net/sched/sch_netem.c |
| @@ -713,7 +713,7 @@ static int get_dist_table(struct Qdisc * |
| int i; |
| size_t s; |
| |
| - if (n > NETEM_DIST_MAX) |
| + if (!n || n > NETEM_DIST_MAX) |
| return -EINVAL; |
| |
| s = sizeof(struct disttable) + n * sizeof(s16); |
