[PATCH net v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[PATCH net v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Jakub Kicinski]

From: Maher Azzouzi <maherazz04@gmail.com>

TCA_MQPRIO_TC_ENTRY_INDEX is validated using
NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
write in the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v3: repost for Maher, email problems..
v2: https://lore.kernel.org/CAFQ-Uc-5ucm+Dyt2s4vV5AyJKjamF=7E_wCWFROYubR5E1PMUg@mail.gmail.com
v2: https://lore.kernel.org/CANn89iJNKR8uBNrRCdqs-M6RspvgSK9+vxzfvXe3xUvDT538Lw@mail.gmail.com
v1: https://lore.kernel.org/20250722155121.440969-1-maherazz04@gmail.com

CC: jhs@mojatatu.com
CC: xiyou.wangcong@gmail.com
CC: jiri@resnulli.us
CC: vladimir.oltean@nxp.com
CC: fejes@inf.elte.hu
---
 net/sched/sch_mqprio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 51d4013b6121..f3e5ef9a9592 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -152,7 +152,7 @@ static int mqprio_parse_opt(struct net_device *dev, struct tc_mqprio_qopt *qopt,
 static const struct
 nla_policy mqprio_tc_entry_policy[TCA_MQPRIO_TC_ENTRY_MAX + 1] = {
 	[TCA_MQPRIO_TC_ENTRY_INDEX]	= NLA_POLICY_MAX(NLA_U32,
-							 TC_QOPT_MAX_QUEUE),
+							 TC_QOPT_MAX_QUEUE - 1),
 	[TCA_MQPRIO_TC_ENTRY_FP]	= NLA_POLICY_RANGE(NLA_U32,
 							   TC_FP_EXPRESS,
 							   TC_FP_PREEMPTIBLE),
-- 
2.50.1

Re: [PATCH net v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Vladimir Oltean]

On Fri, Aug 01, 2025 at 05:18:57PM -0700, Jakub Kicinski wrote:
> From: Maher Azzouzi <maherazz04@gmail.com>
> 
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
> write in the fp[] array, which only has room for 16 elements (0–15).
> 
> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
> 
> Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
> Reviewed-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> v3: repost for Maher, email problems..
> v2: https://lore.kernel.org/CAFQ-Uc-5ucm+Dyt2s4vV5AyJKjamF=7E_wCWFROYubR5E1PMUg@mail.gmail.com
> v2: https://lore.kernel.org/CANn89iJNKR8uBNrRCdqs-M6RspvgSK9+vxzfvXe3xUvDT538Lw@mail.gmail.com
> v1: https://lore.kernel.org/20250722155121.440969-1-maherazz04@gmail.com

Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>

Re: [PATCH net v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  1 Aug 2025 17:18:57 -0700 you wrote:
> From: Maher Azzouzi <maherazz04@gmail.com>
> 
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
> write in the fp[] array, which only has room for 16 elements (0–15).
> 
> [...]

Here is the summary with links:
  - [net,v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
    https://git.kernel.org/netdev/net/c/ffd2dc4c6c49

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net v3] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Fejes Ferenc]

On Sat, 2025-08-02 at 00:18 +0000, Jakub Kicinski wrote:
> From: Maher Azzouzi <maherazz04@gmail.com>
> 
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
> write in the fp[] array, which only has room for 16 elements (0–15).
> 
> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
> 
> Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP
> adminStatus")
> Reviewed-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

LGTM!

Reviewed-by: Ferenc Fejes <fejes@inf.elte.hu>