[PATCH net 1/1] net_sched: sch_fq: Fix out of range band computation

It is possible to compute a band of 3. Doing so will overrun array
q->band_pkt_count[0-2] boundaries.

Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
Reported-by: Coverity Scan <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/sch_fq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 3a31c47fea9b..217c430343df 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c

@@ -159,7 +159,7 @@ struct fq_sched_data {
 /* return the i-th 2-bit value ("crumb") */
 static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
 {
-	return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
+	return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
 }
 
 /*

-- 
2.34.1

On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim [off-list ref] wrote:

Are you sure this is needed ?

fq_load_priomap() makes sure this can not happen...

On Wed, Dec 13, 2023 at 12:30 PM Eric Dumazet [off-list ref] wrote:

On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim [off-list ref] wrote:

quoted

It is possible to compute a band of 3. Doing so will overrun array
q->band_pkt_count[0-2] boundaries.

Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
Reported-by: Coverity Scan <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/sch_fq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 3a31c47fea9b..217c430343df 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c

@@ -159,7 +159,7 @@ struct fq_sched_data {
 /* return the i-th 2-bit value ("crumb") */
 static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
 {
-       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
+       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
 }

Are you sure this is needed ?

According to coverity static analysis.

fq_load_priomap() makes sure this can not happen...

True. Sounds like a false positive because coverity sees the masking
with &0x3 and assumes we could get a result of 3.

cheers,
jamal

On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet [off-list ref] wrote:

On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim [off-list ref] wrote:

quoted

It is possible to compute a band of 3. Doing so will overrun array
q->band_pkt_count[0-2] boundaries.

Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
Reported-by: Coverity Scan <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/sch_fq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 3a31c47fea9b..217c430343df 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c

@@ -159,7 +159,7 @@ struct fq_sched_data {
 /* return the i-th 2-bit value ("crumb") */
 static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
 {
-       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
+       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
 }

Are you sure this is needed ?

fq_load_priomap() makes sure this can not happen...

Yeah, I am pretty sure this patch is incorrect, we need to mask to get
only two bits.

On Wed, Dec 13, 2023 at 12:42 PM Eric Dumazet [off-list ref] wrote:

On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet [off-list ref] wrote:

quoted

On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim [off-list ref] wrote:

quoted

It is possible to compute a band of 3. Doing so will overrun array
q->band_pkt_count[0-2] boundaries.

Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
Reported-by: Coverity Scan <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/sch_fq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 3a31c47fea9b..217c430343df 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c

@@ -159,7 +159,7 @@ struct fq_sched_data {
 /* return the i-th 2-bit value ("crumb") */
 static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
 {
-       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
+       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
 }

Are you sure this is needed ?

fq_load_priomap() makes sure this can not happen...

Yeah, I am pretty sure this patch is incorrect, we need to mask to get
only two bits.

The check in fq_load_priomap() is what makes it moot. Masking with
b'11 could result in b'11. Definitely the modulo will guarantee
whatever results can only be in the range 0..2. But it is not needed.

cheers,
jamal

On Wed, Dec 13, 2023 at 6:53 PM Jamal Hadi Salim [off-list ref] wrote:

On Wed, Dec 13, 2023 at 12:42 PM Eric Dumazet [off-list ref] wrote:

quoted

On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet [off-list ref] wrote:

quoted

On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim [off-list ref] wrote:

quoted

It is possible to compute a band of 3. Doing so will overrun array
q->band_pkt_count[0-2] boundaries.

Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling")
Reported-by: Coverity Scan <redacted>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/sch_fq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 3a31c47fea9b..217c430343df 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c

@@ -159,7 +159,7 @@ struct fq_sched_data {
 /* return the i-th 2-bit value ("crumb") */
 static u8 fq_prio2band(const u8 *prio2band, unsigned int prio)
 {
-       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3;
+       return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3;
 }

Are you sure this is needed ?

fq_load_priomap() makes sure this can not happen...

Yeah, I am pretty sure this patch is incorrect, we need to mask to get
only two bits.

The check in fq_load_priomap() is what makes it moot. Masking with
b'11 could result in b'11. Definitely the modulo will guarantee
whatever results can only be in the range 0..2. But it is not needed.

Modulo would be incorrect, since it would use high order bits.

(0x22 % 3) is different than (0x22 & 3)

Had you written:

return ((prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3) % 3)

Then yes, the last % 3 would be "not needed"