Commit dbeb57d4 authored by Eric Dumazet's avatar Eric Dumazet Committed by Khalid Elmously

sch_netem: fix a divide by zero in tabledist()

BugLink: https://bugs.launchpad.net/bugs/1848589

[ Upstream commit b41d936b ]

syzbot managed to crash the kernel in tabledist() loading
an empty distribution table.

	t = dist->table[rnd % dist->size];

Simply return an error when such load is attempted.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarConnor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent ca4cf834
...@@ -713,7 +713,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr) ...@@ -713,7 +713,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
int i; int i;
size_t s; size_t s;
if (n > NETEM_DIST_MAX) if (!n || n > NETEM_DIST_MAX)
return -EINVAL; return -EINVAL;
s = sizeof(struct disttable) + n * sizeof(s16); s = sizeof(struct disttable) + n * sizeof(s16);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment