All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+398e1ee4ca2cac05fddb@syzkaller.appspotmail.com>
To: takamitz@amazon.co.jp
Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	 takamitz@amazon.co.jp, takamitz@amazon.com
Subject: Re: [syzbot] [net?] WARNING in taprio_get_start_time (2)
Date: Sat, 05 Jul 2025 02:27:48 -0700	[thread overview]
Message-ID: <6868f014.a00a0220.c7b3.0033.GAE@google.com> (raw)
In-Reply-To: <20250705092739.28018-1-takamitz@amazon.co.jp>

> I found validation does not work properly when link speed is large.
> picos_per_byte becomes too small when link speed is large, and
> length_to_duration(q, ETH_ZLEN) becomes zero. This results in failing
> validation in fill_sched_entry() and parse_taprio_schedule(), and any
> entry->interval and cycle_time are permitted.
>
> picos_per_byte should be larger than 16 because ETH_ZLEN (60) *
> &q->picos_per_byte should be larger than PSEC_PER_NSEC=1000.
>
> This report seems to be related this, so let me check the following patch
> resolve the issue.
>
> #syz test

This crash does not have a reproducer. I cannot test it.

>
> diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
> index 2b14c81a87e5..b0a5bd1c9995 100644
> --- a/net/sched/sch_taprio.c
> +++ b/net/sched/sch_taprio.c
> @@ -43,6 +43,11 @@ static struct static_key_false taprio_have_working_mqprio;
>  #define TAPRIO_SUPPORTED_FLAGS \
>  	(TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST | TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD)
>  #define TAPRIO_FLAGS_INVALID U32_MAX
> +/* picos_per_byte should be larger than 16 since duration for minimum ethernet
> + * frame should not be zero.
> + */
> +#define TAPRIO_PICOS_PER_BYTE_MIN 17
> +
>  
>  struct sched_entry {
>  	/* Durations between this GCL entry and the GCL entry where the
> @@ -1299,7 +1304,7 @@ static void taprio_set_picos_per_byte(struct net_device *dev,
>  		speed = ecmd.base.speed;
>  
>  skip:
> -	picos_per_byte = (USEC_PER_SEC * 8) / speed;
> +	picos_per_byte = max((USEC_PER_SEC * 8) / speed, TAPRIO_PICOS_PER_BYTE_MIN);
>  
>  	atomic64_set(&q->picos_per_byte, picos_per_byte);
>  	netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n",

      reply	other threads:[~2025-07-05  9:27 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-13 16:44 [syzbot] [net?] WARNING in taprio_get_start_time (2) syzbot
2025-07-05  9:27 ` Takamitsu Iwai
2025-07-05  9:27   ` syzbot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6868f014.a00a0220.c7b3.0033.GAE@google.com \
    --to=syzbot+398e1ee4ca2cac05fddb@syzkaller.appspotmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=takamitz@amazon.co.jp \
    --cc=takamitz@amazon.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.