From 2623734d932ca28d88cccb2e4074a943e549faec Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 14 May 2019 10:37:25 +0800 Subject: [PATCH] tuntap: fix dividing by zero in ebpf queue selection mainline inclusion from mainline-5.1 commit a35d310f03a692bf4798eb309a1950a06a150620 category: bugfix bugzilla: 13267 CVE: NA ------------------------------------------------- We need check if tun->numqueues is zero (e.g for the persist device) before trying to use it for modular arithmetic. Reported-by: Eric Dumazet Fixes: 96f84061620c6("tun: add eBPF based queue selection method") Signed-off-by: Jason Wang Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: YueHaibing Reviewed-by: Mao Wenan Signed-off-by: Yang Yingliang --- drivers/net/tun.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 79b4f9ce194f..e60d6f6d9201 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -599,13 +599,18 @@ static u16 tun_automq_select_queue(struct tun_struct *tun, struct sk_buff *skb) static u16 tun_ebpf_select_queue(struct tun_struct *tun, struct sk_buff *skb) { struct tun_prog *prog; + u32 numqueues; u16 ret = 0; + numqueues = READ_ONCE(tun->numqueues); + if (!numqueues) + return 0; + prog = rcu_dereference(tun->steering_prog); if (prog) ret = bpf_prog_run_clear_cb(prog->prog, skb); - return ret % tun->numqueues; + return ret % numqueues; } static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb, -- GitLab