From nobody Thu Apr 2 17:32:51 2026 Received: from mail-oa1-f48.google.com (mail-oa1-f48.google.com [209.85.160.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FED7350A21 for ; Wed, 11 Feb 2026 19:43:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770839013; cv=none; b=FDK8J83cHFxUZSyA/jYz4gVfgrVTbLGpaismWsiewbT7dCcOjkifMpf1a6EPVZPeyXylsFsGHIk4Ri1OI7b0uon0MPREUoabbZBlvja9+lLm9Nv7tM6Qo7UlpODinZw4WB/RKj3RQiYjK7iJZ/GSfNwGM2eakMI5JknpgAzd65Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770839013; c=relaxed/simple; bh=ZWbPqJQii6H8WyeXZM+tCMZQu3W2Yff2gbsayOOGiPY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=XYHeRrdFxbDrRWbYZ/oLA2vjxeexsJx7uh1bznVnC88x+Xvpygo/3ZtzErym1NGo6QPqcRI+prGuvkjZRDBZzeD3iFmzqOkkT4zHl/mg/smZ7a8pCW/DYrvnR9gUiv6+zkHDwJLqo5LSRp/oTK/HOYjg16FLABJJ4Bsy6KsceIQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iZV3+YpQ; arc=none smtp.client-ip=209.85.160.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iZV3+YpQ" Received: by mail-oa1-f48.google.com with SMTP id 586e51a60fabf-40866608701so1279332fac.1 for ; Wed, 11 Feb 2026 11:43:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770839010; x=1771443810; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0a9gQYVVISPj2gmgBnG3tylapu0SzuOdddpgIvGc12s=; b=iZV3+YpQp/V6DKuuOwLiVZJRJlURIwsjjAKm3aid2r3/5/qDfyFdrn8wP+ekZ76kYO cJBiVlS6Xe6qPXedhx+PSYC7FiVNwFDTGIXdrGxtDYM8ou0BNoVm3mIrPhDHpyl+VZuZ k0hIMmdlACa9IznX3a/CRmjM6YxKMdYiQgX46/2vYMa9Ot5ge9IM+2sUwh1mQGz+PbCT PzcIAA5hxlthhqKUCZQuxHrjvnz29lIGwNCcN4oiVl9t/NNyQ+ogMv1p3BHonA/b2dTD x/3/k60wKt/SotaXjw88XRmVcZIulqfSZyk3UyL5DjxoKKSj7ij5m+iwAJdZFHvl3xHI pdCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770839010; x=1771443810; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=0a9gQYVVISPj2gmgBnG3tylapu0SzuOdddpgIvGc12s=; b=iKe7wdsjBazDROIxOpMU/mI3exdYELN627hbZeoMpMw2nxqfKzP0IW6vVUFC5GV8U9 Qh5+ch8WjnsCOd4fViDzHV3l4EVyXisiwKigAJ51vcJGWQ3M1STOnaHUyKghWDwV+k4R 9d/2zrRBSm93tjEHjkXc+Ywoo4+NuT2JOYFxsiqhSLHQZBLYmtcj6AYdut+lLPHv4fOA EM23QqhQIWTxMWtpIHW6Tqm4wRuUKUIaCcBlnGIOQIEyxHn9mdDoZ5yUTZOksKw6Damg 1wiq74m3vyatA5MAhFEk3MsNzU9PRsA0tqdVj2F/cdAtg0AFfAVxjQbxeW+d5WWi18mV h5cQ== X-Forwarded-Encrypted: i=1; AJvYcCVAUrreMKSfBCHHxfCIzZZ6VVumTBvROvR0zgSLrrIU/jB/K1lskdu1uIMFGqWYmGNapL/n3gqdShn3qg0=@vger.kernel.org X-Gm-Message-State: AOJu0Yz5i/1V3YIXcRBN1HFwc/Ad/vl8gQdYR0pW1UuIyJYHZdjIYzdS ZyIrIkP77VT/s4HG4Nx8Bij9AULgRilHfZdAsL+iYwRXRebIoTkMzC3u X-Gm-Gg: AZuq6aLkuT3j4zk9lxvITyBYyUCDtJqqRuf+z0yONOENwilnC0+EwEUK3lSEQrMamWa CFpVpyiXfLw/kiNg3gPiXdFVKMN0S/FwgHcxInj4u/2pexvHuMgvkD9XSfdklw8P3ruN//exlmE fnUW6bONtHd07ANsVtNUVtnOvLeLfyrsHeON7+FuOrDgw/AhL8R8uddQByqJDNMwr1oYv0UroyN albIYicsYJN6lz1u4bIiNbhRAO6ogSaoXANnTCx4boNk+FOpYKGT51OfHMDBtKr9H+VE9YkgWfJ f1OZvurer+1yAHY5hTlpZRLOv5OarkJNruR/k7Mxnxknk8HoPbUkFYsHAsVw6JHwyVdttQUMAP4 MTh7/4bPqip9rGnzdn58RrIUcSPzvdadhlYk9ge9ACLyTbJczjuBjfzCIwSXxupUie7JEBG2vJz AC91iyuvhDJChUzHCh3GOmXgJiWghbN9e2KaYtB7o8B6oxpf3y3ljF/PNEQCJkvpv4Rvc2mOt+ X-Received: by 2002:a05:6870:3342:b0:409:794e:fe9 with SMTP id 586e51a60fabf-40ec74775e9mr153681fac.54.1770839010010; Wed, 11 Feb 2026 11:43:30 -0800 (PST) Received: from ubuntu-BQM5.tailafa00.ts.net (cs244-84-dhcp.cs.colorado.edu. [128.138.244.84]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-40eaf1e858bsm1989412fac.19.2026.02.11.11.43.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Feb 2026 11:43:28 -0800 (PST) From: Ruitong Liu To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, linux-kernel@vger.kernel.org, Ruitong Liu , stable@vger.kernel.org, Shuyuan Liu Subject: [PATCH v2] net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Date: Thu, 12 Feb 2026 03:43:25 +0800 Message-Id: <20260211194325.797963-1-cnitlrt@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260211184848.731894-1-cnitlrt@gmail.com> References: <20260211184848.731894-1-cnitlrt@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. mapping_mod is computed as: mapping_mod =3D queue_mapping_max - queue_mapping + 1; mapping_mod is stored as u16, so the calculation can overflow when the requested range covers 65536 queues (e.g. queue_mapping=3D0 and queue_mapping_max=3D0xffff). In that case mapping_mod wraps to 0 and tcf_skbedit_hash() triggers a divide-by-zero: queue_mapping +=3D skb_get_hash(skb) % params->mapping_mod; Reject such invalid configuration to prevent mapping_mod from becoming 0 and avoid the crash. Fixes: 38a6f0865796 ("net: sched: support hash selecting tx queue") Cc: stable@vger.kernel.org # 6.12+ Reported-by: Ruitong Liu Reported-by: Shuyuan Liu Signed-off-by: Ruitong Liu --- net/sched/act_skbedit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c index 8c1d1554f657..b6f5c21651fc 100644 --- a/net/sched/act_skbedit.c +++ b/net/sched/act_skbedit.c @@ -194,6 +194,10 @@ static int tcf_skbedit_init(struct net *net, struct nl= attr *nla, } =20 mapping_mod =3D *queue_mapping_max - *queue_mapping + 1; + if (!mapping_mod) { + NL_SET_ERR_MSG_MOD(extack, "Invalid queue_mapping range: range too lar= ge"); + return -EINVAL; + } flags |=3D SKBEDIT_F_TXQ_SKBHASH; } if (*pure_flags & SKBEDIT_F_INHERITDSFIELD) --=20 2.34.1