On Wed, 28 Oct 2020 17:07:31 +0000 Aleksandr Nogikh <[email protected]> wrote:
> From: Aleksandr Nogikh <[email protected]> > > Currently it is possible to craft a special netlink RTM_NEWQDISC > command that can result in jitter being equal to 0x80000000. It is > enough to set the 32 bit jitter to 0x02000000 (it will later be > multiplied by 2^6) or just set the 64 bit jitter via > TCA_NETEM_JITTER64. This causes an overflow during the generation of > uniformly distributed numbers in tabledist(), which in turn leads to > division by zero (sigma != 0, but sigma * 2 is 0). > > The related fragment of code needs 32-bit division - see commit > 9b0ed89 ("netem: remove unnecessary 64 bit modulus"), so switching to > 64 bit is not an option. > > Fix the issue by keeping the value of jitter within the range that can > be adequately handled by tabledist() - [0;INT_MAX]. As negative std > deviation makes no sense, take the absolute value of the passed value > and cap it at INT_MAX. Inside tabledist(), switch to unsigned 32 bit > arithmetic in order to prevent overflows. > > Signed-off-by: Aleksandr Nogikh <[email protected]> > Reported-by: [email protected] Acked-by: Stephen Hemminger <[email protected]>
