Commit d64cb81d authored by Yucheng Lu's avatar Yucheng Lu Committed by Jakub Kicinski
Browse files

net/sched: sch_netem: fix out-of-bounds access in packet corruption 



In netem_enqueue(), the packet corruption logic uses
get_random_u32_below(skb_headlen(skb)) to select an index for
modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear
packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.

Passing 0 to get_random_u32_below() takes the variable-ceil slow path
which returns an unconstrained 32-bit random integer. Using this
unconstrained value as an offset into skb->data results in an
out-of-bounds memory access.

Fix this by verifying skb_headlen(skb) is non-zero before attempting
to corrupt the linear data area. Fully non-linear packets will silently
bypass the corruption logic.

Fixes: c865e5d9 ("[PKT_SCHED] netem: packet corruption option")
Reported-by: default avatarYifan Wu <yifanwucs@gmail.com>
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Signed-off-by: default avatarYuan Tan <tanyuan98@outlook.com>
Signed-off-by: default avatarXin Liu <bird@lzu.edu.cn>
Signed-off-by: default avatarYuhang Zheng <z1652074432@gmail.com>
Signed-off-by: default avatarYucheng Lu <kanolyc@gmail.com>
Reviewed-by: default avatarStephen Hemminger <stephen@networkplumber.org>
Link: https://patch.msgid.link/45435c0935df877853a81e6d06205ac738ec65fa.1774941614.git.kanolyc@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent aba53ccf

net/sched/sch_netem.c

+3 −2
Original line number Diff line number Diff line
@@ -519,6 +519,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
			goto finish_segs;

		}



		if (skb_headlen(skb))

			skb->data[get_random_u32_below(skb_headlen(skb))] ^=

				1 << get_random_u32_below(8);

	}