Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. mapping_mod is computed as: mapping_mod = queue_mapping_max - queue_mapping + 1; mapping_mod is stored as u16, so the calculation can overflow when the requested range covers 65536 queues (e.g. queue_mapping=0 and queue_mapping_max=0xffff). In that case mapping_mod wraps to 0 and tcf_skbedit_hash() triggers a divide-by-zero: queue_mapping += skb_get_hash(skb) % params->mapping_mod; Reject such invalid configuration to prevent mapping_mod from becoming 0 and avoid the crash. Fixes: 38a6f0865796 ("net: sched: support hash selecting tx queue") Cc: stable@vger.kernel.org # 6.12+ Reported-by: Ruitong Liu Reported-by: Shuyuan Liu Signed-off-by: Ruitong Liu --- net/sched/act_skbedit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c index 8c1d1554f657..b6f5c21651fc 100644 --- a/net/sched/act_skbedit.c +++ b/net/sched/act_skbedit.c @@ -194,6 +194,10 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, } mapping_mod = *queue_mapping_max - *queue_mapping + 1; + if (!mapping_mod) { + NL_SET_ERR_MSG_MOD(extack, "Invalid queue_mapping range: range too large"); + return -EINVAL; + } flags |= SKBEDIT_F_TXQ_SKBHASH; } if (*pure_flags & SKBEDIT_F_INHERITDSFIELD) -- 2.34.1