[PATCH net] net/sched: act_ife: validate metadata length before decoding

[Fang Xieyan <fangxy@xiaopeng.com>]

skbmark_decode(), skbprio_decode() and skbtcindex_decode() read fixed-size
values from the TLV payload without validating its length.

A malformed IFE frame can declare a shorter payload, causing the decoders
to consume bytes beyond the declared metadata value:

[TLV type=IFE_META_SKBMARK len=4]
-> dlen == 0, but decode reads 4 bytes

The decoder may therefore set skb metadata from unintended input.

Validate the payload length before decoding and return -EINVAL for
invalid lengths. The caller treats decoder failures as per-TLV errors
and continues decoding the remaining metadata.

Fixes: 084e2f6566d2 ("Support to encoding decoding skb mark on IFE action")
Fixes: 200e10f46936 ("Support to encoding decoding skb prio on IFE action")
Fixes: 408fbc22ef1e ("net sched ife action: Introduce skb tcindex metadata encap decap")
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---

Found by auditing the IFE decode path at v6.18-rc7. The malformed
metadata cases were reproduced with a userspace sanitizer model of
the decode path, which reported reads of size 4/2 for dlen values
smaller than the expected metadata size.

Compile-tested on x86_64 with defconfig and NET_ACT_IFE=y: act_ife.o
and the three act_meta_*.o build warning-free.

 net/sched/act_meta_mark.c       | 6 +++++-
 net/sched/act_meta_skbprio.c    | 6 +++++-
 net/sched/act_meta_skbtcindex.c | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/net/sched/act_meta_mark.c b/net/sched/act_meta_mark.c
index ea0573cb8b2d..3a7d568df0da 100644
--- a/net/sched/act_meta_mark.c
+++ b/net/sched/act_meta_mark.c
@@ -28,8 +28,12 @@ static int skbmark_encode(struct sk_buff *skb, void *skbdata,
 
 static int skbmark_decode(struct sk_buff *skb, void *data, u16 len)
 {
-	u32 ifemark = *(u32 *)data;
+	u32 ifemark;
 
+	if (len != sizeof(ifemark))
+		return -EINVAL;
+
+	ifemark = *(u32 *)data;
 	skb->mark = ntohl(ifemark);
 	return 0;
 }
diff --git a/net/sched/act_meta_skbprio.c b/net/sched/act_meta_skbprio.c
index 2df3133ce5ad..fa4ba4269ca0 100644
--- a/net/sched/act_meta_skbprio.c
+++ b/net/sched/act_meta_skbprio.c
@@ -33,8 +33,12 @@ static int skbprio_encode(struct sk_buff *skb, void *skbdata,
 
 static int skbprio_decode(struct sk_buff *skb, void *data, u16 len)
 {
-	u32 ifeprio = *(u32 *)data;
+	u32 ifeprio;
 
+	if (len != sizeof(ifeprio))
+		return -EINVAL;
+
+	ifeprio = *(u32 *)data;
 	skb->priority = ntohl(ifeprio);
 	return 0;
 }
diff --git a/net/sched/act_meta_skbtcindex.c b/net/sched/act_meta_skbtcindex.c
index 44547caead46..48f001ada8f6 100644
--- a/net/sched/act_meta_skbtcindex.c
+++ b/net/sched/act_meta_skbtcindex.c
@@ -28,8 +28,12 @@ static int skbtcindex_encode(struct sk_buff *skb, void *skbdata,
 
 static int skbtcindex_decode(struct sk_buff *skb, void *data, u16 len)
 {
-	u16 ifetc_index = *(u16 *)data;
+	u16 ifetc_index;
 
+	if (len != sizeof(ifetc_index))
+		return -EINVAL;
+
+	ifetc_index = *(u16 *)data;
 	skb->tc_index = ntohs(ifetc_index);
 	return 0;
 }
-- 
2.50.1