From nobody Thu Apr 2 17:32:51 2026 Received: from mail-oi1-f173.google.com (mail-oi1-f173.google.com [209.85.167.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 303541946BC for ; Wed, 11 Feb 2026 18:48:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770835736; cv=none; b=L761uQg2pYq0fXnnkqwa7HLHxErD1ZnhxpTguMUhjUs27ERSCmdPpwcxh1H4QglV2WziSI6hXRJoL8nv+RarrM5Po3T77lIZ2CIiWuO9a0FED1A2DWYZGGKAvFuim9n22M8rqs6YoWEbPJ1cVd6KqR+FQi0QSnapUxRAtGuBEN0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770835736; c=relaxed/simple; bh=64wP/MM5aS1KZwEtPUURBoztSsWJq7sZ8lz29bEnzbg=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Q76LBMMVYidmytjgGjsLQqZJuLFEpuBUquaw8SE3QfD6SL/I9JnrwwSwVRFrgA+54gw2KTScUANy6QlSp/Xw/dd0c95mJdd0rp89NlSrrPPMQX1KBCn5zm1WGFiVCHvBShvqxzsc+96crMN3E3xfbG7ujpQ8ICoPMJJIklMBv/M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j4mIg6u9; arc=none smtp.client-ip=209.85.167.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j4mIg6u9" Received: by mail-oi1-f173.google.com with SMTP id 5614622812f47-45c89d754dfso2246229b6e.1 for ; Wed, 11 Feb 2026 10:48:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770835733; x=1771440533; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+j1rSO6NXTG8aA4FojBq5FRy5AxHZkP/gu9Rybi+aRI=; b=j4mIg6u9wJldM8MKKgBWQDo+Ira7dNhwGNOcbii668kfxJFP6jVmIb9uJbYbNqTB7N 5wDDgg5QOrl0Mga+CmXfxnkbKmzqy97jshAGDLbvzNz2BwpwsYB8oLWfU+hV8ZquTClu 39Lin/Z57EU7gBhQ6sPj5SV3XqynznXZv6MdN5fag27kKAIJRbHYvcrCJFSKwWs1+Z2M /d/5fTCplqfXCeYzXja1/aWCLbNZ6DP+4iJ/hZuBaFQVyl3ZqAKqBMhdoyqrNlA2szCZ zHzI5NmOoWL/RH2E4GERtDXoDy6cLY41iQrZmJMSZ8qhqDA2vZMzPRg07IJK/nsak3Bk mnuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770835733; x=1771440533; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+j1rSO6NXTG8aA4FojBq5FRy5AxHZkP/gu9Rybi+aRI=; b=X6v9fqc+aqGQmNFAH5sTNWpWd7nffdEk4U7NKpqDW5bvT+MsAtO+4Xah1UPCw+Zgvc V6PMwIG4WXMqtT+ppt87M/jPYnqdI8vZJURNBjx/4reGwjAL28R955tsCIL8nVZrwDbz DUg9+FuSYk2cTyaC536z4iKDSwmRUdEmgNQR/BFydeS6zNlWon4mTG7ykZSjizeZnm0m S2NORy2f25+SYtXwtLjCS88BBTQBt30BDNN9lz9fkMv2cG6cF+qLY6FK3P4agXHJByUC /bpApooQnWMLSVkRw24qLZvy9YBtW5zQ4Xa4hxjLZtbXIvMPFEIw0LYquq0m+z1ihL/k Ld+w== X-Forwarded-Encrypted: i=1; AJvYcCUmyOb2yUK/7FQYQJM7H6H0uGXR+e060kPmFwnllf0ZR51P/4Bvcc8U7+ZqWa1hjWvGDAbCLlqw61MZnnU=@vger.kernel.org X-Gm-Message-State: AOJu0YxtnMsFZFwZP7oVvT1fZJs/v/uiP+RLL3Tk9EbFEPQGXKxMcbOm 4t+5E/11aTB1yPXLR7Ttifxk0bdYGL5uDFmYrrMDhzJTIbSdDG8gBL3u X-Gm-Gg: AZuq6aLN8pTQm254OrvNuTAIb03XBCK5XGo6EU0SIAa99qz9NBxCLwH2x9rTEdasPfR w4CkxVQmE+/JPsNvImEESugDPdfmlDX3+WQ3LbgZEUdDNC3W9XzmsnJkDyNLWgVDYXeekurh1Lf zxmtgovY9pT/M6nYWCuQTjo/2JblPnirzMv9mE2e3UmSfxm4wP/IVCPpZcekYRycTdVDN3eQZCO DsDhLQDwKz3vf5RR/7ZNU2Ggn0aZYsRu3lmFvUYNp/08q5M7UGuj8LKBY9Uz26S7kycifFkAcKg ICzb45Fa5hiw96ZY3IMUKL3tTYNM5m0mU8GWtyowGa5BrpIyFQVypmWMxtTB9k6AFA0YS8HTm0Z jsXj5Gngl8OKD3t4e6yrvFpBnymM8n88ldO56+6pCNh8zSGE47HjLemWUwm8kdW86Cr7l2E+PLC CaeyfTndL6OW8ld1auNsG1+gYHUe8xWtihsbDk8HkgdpydwrtunZnj8OzQOMA4jLc5vfXlsmFc X-Received: by 2002:a05:6808:1a2a:b0:45e:f8af:e2f with SMTP id 5614622812f47-4637b6797ebmr185578b6e.15.1770835733090; Wed, 11 Feb 2026 10:48:53 -0800 (PST) Received: from ubuntu-BQM5.tailafa00.ts.net (cs244-84-dhcp.cs.colorado.edu. [128.138.244.84]) by smtp.gmail.com with ESMTPSA id 5614622812f47-4636ae92b6dsm1439719b6e.4.2026.02.11.10.48.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Feb 2026 10:48:51 -0800 (PST) From: Ruitong Liu To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, linux-kernel@vger.kernel.org, Ruitong Liu , stable@vger.kernel.org, Shuyuan Liu Subject: [PATCH] net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Date: Thu, 12 Feb 2026 02:48:48 +0800 Message-Id: <20260211184848.731894-1-cnitlrt@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mapping_mod is computed as: mapping_mod =3D queue_mapping_max - queue_mapping + 1; mapping_mod is stored as u16, so the calculation can overflow when queue_mapping=3D0 and queue_mapping_max=3D0xffff. In this case the value wraps to 0, leading to a divide-by-zero in tcf_skbedit_hash(): queue_mapping +=3D skb_get_hash(skb) % params->mapping_mod; Fix it by using a wider type for mapping_mod and performing the calculation in u32, preventing overflow to zero. Fixes: 38a6f0865796 ("net: sched: support hash selecting tx queue") Cc: stable@vger.kernel.org # 6.12+ Reported-by: Ruitong Liu Reported-by: Shuyuan Liu Signed-off-by: Ruitong Liu --- include/net/tc_act/tc_skbedit.h | 2 +- net/sched/act_skbedit.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedi= t.h index 31b2cd0bebb5..1353bcb15ac7 100644 --- a/include/net/tc_act/tc_skbedit.h +++ b/include/net/tc_act/tc_skbedit.h @@ -18,7 +18,7 @@ struct tcf_skbedit_params { u32 mark; u32 mask; u16 queue_mapping; - u16 mapping_mod; + u32 mapping_mod; u16 ptype; struct rcu_head rcu; }; diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c index 8c1d1554f657..52f6ea6436b9 100644 --- a/net/sched/act_skbedit.c +++ b/net/sched/act_skbedit.c @@ -26,7 +26,7 @@ static struct tc_action_ops act_skbedit_ops; static u16 tcf_skbedit_hash(struct tcf_skbedit_params *params, struct sk_buff *skb) { - u16 queue_mapping =3D params->queue_mapping; + u32 queue_mapping =3D params->queue_mapping; =20 if (params->flags & SKBEDIT_F_TXQ_SKBHASH) { u32 hash =3D skb_get_hash(skb); @@ -34,7 +34,7 @@ static u16 tcf_skbedit_hash(struct tcf_skbedit_params *pa= rams, queue_mapping +=3D hash % params->mapping_mod; } =20 - return netdev_cap_txqueue(skb->dev, queue_mapping); + return netdev_cap_txqueue(skb->dev, (u16)queue_mapping); } =20 TC_INDIRECT_SCOPE int tcf_skbedit_act(struct sk_buff *skb, @@ -126,7 +126,7 @@ static int tcf_skbedit_init(struct net *net, struct nla= ttr *nla, struct tcf_skbedit *d; u32 flags =3D 0, *priority =3D NULL, *mark =3D NULL, *mask =3D NULL; u16 *queue_mapping =3D NULL, *ptype =3D NULL; - u16 mapping_mod =3D 1; + u32 mapping_mod =3D 1; bool exists =3D false; int ret =3D 0, err; u32 index; @@ -193,7 +193,7 @@ static int tcf_skbedit_init(struct net *net, struct nla= ttr *nla, return -EINVAL; } =20 - mapping_mod =3D *queue_mapping_max - *queue_mapping + 1; + mapping_mod =3D (u32)(*queue_mapping_max) - (u32)(*queue_mapping) + 1; flags |=3D SKBEDIT_F_TXQ_SKBHASH; } if (*pure_flags & SKBEDIT_F_INHERITDSFIELD) @@ -319,7 +319,7 @@ static int tcf_skbedit_dump(struct sk_buff *skb, struct= tc_action *a, pure_flags |=3D SKBEDIT_F_INHERITDSFIELD; if (params->flags & SKBEDIT_F_TXQ_SKBHASH) { if (nla_put_u16(skb, TCA_SKBEDIT_QUEUE_MAPPING_MAX, - params->queue_mapping + params->mapping_mod - 1)) + (u16)(params->queue_mapping + params->mapping_mod - 1))) goto nla_put_failure; =20 pure_flags |=3D SKBEDIT_F_TXQ_SKBHASH; --=20 2.34.1