In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: extend minimum interval restriction to entire cycle too
It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the taprio UAPI permits a cycle-time different from (and potentially shorter than) the sum of entry intervals.
We need one more restriction, which is that the cycle time itself must be larger than N * ETHZLEN bit times, where N is the number of schedule entries. This restriction needs to apply regardless of whether the cycle time came from the user or was the implicit, auto-calculated value, so we move the existing "cycle == 0" check outside the "if "(!new->cycletime)" branch. This way covers both conditions and scenarios.
Add a selftest which illustrates the issue triggered by syzbot.
[
{
"signature_type": "Line",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b939d1e04a90248b4cdf417b0969c270ceb992b2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"179945328623880515066783338714461985511",
"316658585885017558318141780064588700961",
"972111619145568470326643111837611380",
"98799264343235432475115437528689661916",
"33860785941016769566464966516697454270",
"92496636453117351427375144093706679318",
"132830679995236212364102018947394272085",
"169966142315878265380294633761659056518",
"318840122789637509070530795209353665742",
"60814161346067431432381992473404886991"
]
},
"id": "CVE-2024-36244-456cd3fc",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "net/sched/sch_taprio.c"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34d83c3e6e97867ae061d14eb52123404aab1cbc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"179945328623880515066783338714461985511",
"316658585885017558318141780064588700961",
"972111619145568470326643111837611380",
"98799264343235432475115437528689661916",
"33860785941016769566464966516697454270",
"92496636453117351427375144093706679318",
"132830679995236212364102018947394272085",
"92455941342073795997532840820987217268",
"169810943671941640434175119343914276330",
"149421092000435868038725621490262930480"
]
},
"id": "CVE-2024-36244-c674f1f7",
"signature_version": "v1"
}
]