[PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[maher azz]

From: Maher Azzouzi <maherazz04@gmail.com>

TCA_MQPRIO_TC_ENTRY_INDEX is validated using
NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in
the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP
adminStatus")

Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
---
 net/sched/sch_mqprio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 51d4013b6121..f3e5ef9a9592 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -152,7 +152,7 @@ static int mqprio_parse_opt(struct net_device
*dev, struct tc_mqprio_qopt *qopt,
 static const struct
 nla_policy mqprio_tc_entry_policy[TCA_MQPRIO_TC_ENTRY_MAX + 1] = {
        [TCA_MQPRIO_TC_ENTRY_INDEX]     = NLA_POLICY_MAX(NLA_U32,
-                                                        TC_QOPT_MAX_QUEUE),
+                                                        TC_QOPT_MAX_QUEUE - 1),
        [TCA_MQPRIO_TC_ENTRY_FP]        = NLA_POLICY_RANGE(NLA_U32,
                                                           TC_FP_EXPRESS,
                                                           TC_FP_PREEMPTIBLE),
--
2.34.1

Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Jakub Kicinski]

On Tue, 29 Jul 2025 16:39:26 +0100 maher azz wrote:
> From: Maher Azzouzi <maherazz04@gmail.com>
> 
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in
> the fp[] array, which only has room for 16 elements (0–15).
> 
> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
> 
> Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP
> adminStatus")

Don't wrap the Fixes tags;

> 

no empty lines between tags;

> Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>

your email client is corrupting the emails, tabs get replaced with
spaces. Please add the review tag you received from Eric on v1 and
try sending v3 with git send-email?
-- 
pw-bot: cr

Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Simon Horman]

On Sat, Aug 02, 2025 at 12:25:24AM +0100, maher azz wrote:
> Can someone please do it instead of me just keep me as the reporter please?
> this is too complicated, it gets rejected even if im missing a space or a
> newline
> 
> Thanks for your help and time to review this.

Sure, will do.

Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Vladimir Oltean]

On Mon, Aug 04, 2025 at 11:49:37AM +0100, Simon Horman wrote:
> On Sat, Aug 02, 2025 at 12:25:24AM +0100, maher azz wrote:
> > Can someone please do it instead of me just keep me as the reporter please?
> > this is too complicated, it gets rejected even if im missing a space or a
> > newline
> > 
> > Thanks for your help and time to review this.
> 
> Sure, will do.

Jakub already sent MessageID 20250802001857.2702497-1-kuba@kernel.org.

Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Simon Horman]

On Mon, Aug 04, 2025 at 01:50:46PM +0300, Vladimir Oltean wrote:
> On Mon, Aug 04, 2025 at 11:49:37AM +0100, Simon Horman wrote:
> > On Sat, Aug 02, 2025 at 12:25:24AM +0100, maher azz wrote:
> > > Can someone please do it instead of me just keep me as the reporter please?
> > > this is too complicated, it gets rejected even if im missing a space or a
> > > newline
> > > 
> > > Thanks for your help and time to review this.
> > 
> > Sure, will do.
> 
> Jakub already sent MessageID 20250802001857.2702497-1-kuba@kernel.org.

Thanks, I hadn't noticed that.

Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Eric Dumazet]

On Tue, Jul 29, 2025 at 8:36 AM maher azz <maherazz04@gmail.com> wrote:
>
> From: Maher Azzouzi <maherazz04@gmail.com>
>
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in
> the fp[] array, which only has room for 16 elements (0–15).
>
> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
>
> Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
>
> Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
>

Reviewed-by: Eric Dumazet <edumazet@google.com>