Re: [PATCH net 1/1] net: atm: reject out-of-range traffic classes in QoS validation

[Simon Horman <horms@kernel.org>]

On Tue, Jun 09, 2026 at 04:34:37PM +0800, Ren Wei wrote:
> From: Zhengchuan Liang <zcliangcn@gmail.com>
> 
> Reject ATM traffic classes above ATM_ANYCLASS in check_tp().
> SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so
> accepting larger values leaves invalid traffic_class values in
> vcc->qos.
> 
> That bad state later reaches pvc_info(), which indexes class_name[]
> with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause
> an out-of-bounds read when /proc/net/atm/pvc is read.
> 
> Tighten the existing QoS validation so invalid traffic_class values
> are rejected at the point where user supplied QoS is accepted.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Reviewed-by: Simon Horman <horms@kernel.org>

I believe the issue flagged by AI-generated review on
https://netdev-ai.bots.linux.dev/sashiko/ is a false positive.