Commit 700465fd authored Oct 22, 2020 by Ke Li Committed by Jakub Kicinski Oct 22, 2020

net: Properly typecast int values to set sk_max_pacing_rate



In setsockopt(SO_MAX_PACING_RATE) on 64bit systems, sk_max_pacing_rate,
after extended from 'u32' to 'unsigned long', takes unintentionally
hiked value whenever assigned from an 'int' value with MSB=1, due to
binary sign extension in promoting s32 to u64, e.g. 0x80000000 becomes
0xFFFFFFFF80000000.

Thus inflated sk_max_pacing_rate causes subsequent getsockopt to return
~0U unexpectedly. It may also result in increased pacing rate.

Fix by explicitly casting the 'int' value to 'unsigned int' before
assigning it to sk_max_pacing_rate, for zero extension to happen.

Fixes: 76a9ebe8 ("net: extend sk_pacing_rate to unsigned long")
Signed-off-by: Ji Li <jli@akamai.com>
Signed-off-by: Ke Li <keli@akamai.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201022064146.79873-1-keli@akamai.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 594850ca

net/core/filter.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4733,7 +4733,8 @@ static int _bpf_setsockopt(struct sock *sk, int level, int optname,
		cmpxchg(&sk->sk_pacing_status,
		SK_PACING_NONE,
		SK_PACING_NEEDED);
		sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
		sk->sk_max_pacing_rate = (val == ~0U) ?
		~0UL : (unsigned int)val;
		sk->sk_pacing_rate = min(sk->sk_pacing_rate,
		sk->sk_max_pacing_rate);
		break;

net/core/sock.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1163,7 +1163,7 @@ set_sndbuf:

		case SO_MAX_PACING_RATE:
		{
		unsigned long ulval = (val == ~0U) ? ~0UL : val;
		unsigned long ulval = (val == ~0U) ? ~0UL : (unsigned int)val;

		if (sizeof(ulval) != sizeof(val) &&
		optlen >= sizeof(ulval) &&

Admin message