[PATCH net] net: page_pool: bound queue_idx before indexing dev->_rx[]

[Dudu Lu <phx0fer@gmail.com>]

page_pool_init() calls __netif_get_rx_queue(pool->slow.netdev,
pool->slow.queue_idx), which is a bare `dev->_rx + rxq` with no bound,
and then dereferences the result (rxq->mp_params.mp_priv / .mp_ops).  A
queue_idx at or beyond real_num_rx_queues reads past the dev->_rx[]
allocation:

  BUG: KASAN: slab-out-of-bounds in page_pool_create_percpu+0xa74/0xafc
  Read of size 8 at addr ffff000006587eb8 by task kworker/0:1/11
   page_pool_create_percpu+0xa74/0xafc
   page_pool_create+0x14/0x20
   ppidx_work+0x2d8/0x34c [ppidx_probe]

queue_idx comes from the driver's page_pool_params, so validate it
against the device before using it to index the queue array.

Fixes: 0f9214046893 ("memory-provider: dmabuf devmem memory provider")
Assisted-by: LLM
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
Tested base
-----------
Detected on Linux 7.3-rc4 (commit 93f51579e7df), arm64 QEMU guest.
Re-checked against mainline f47d223627f8 (v7.3-341): the affected code
is unchanged between the two, so the bug is still present there.
Checked against linux-next next-20261021 (commit 9a482184d910): the
affected code is unchanged there as well, so the bug is still present in
linux-next too.

Reproducer status
-----------------
A reproducer was written and executed on an arm64 QEMU guest (KASAN); it
fires at the claimed sink.  The reproducer source is not posted here per
Documentation/process/security-bugs.rst; it is available on request.

Triggering conditions
---------------------
queue_idx is supplied by the driver alongside PP_FLAG_ALLOW_UNREADABLE_NETMEM
(the gve, bnxt, bnge, fbnic and mlx5 rx paths all set both); it is the
driver's own rx queue index, so an in-tree driver passes a valid value.
page_pool_init() still indexes dev->_rx[] with it while only asserting that
the netdev lock is held, never checking it against real_num_rx_queues, so
the exported API trusts the caller for the bound.  This is a sink-side
hardening fix for page_pool_create_percpu(); the QEMU guest used for the
reproducer has no such NIC, so the pool was created through a small module.

Notes
-----
Built and checkpatch-clean: this patch was applied on top of 7.3-rc4
(commit 93f51579e7df) and a full arm64 kernel (defconfig) was built with
it -- no new warnings or errors.  scripts/checkpatch.pl reports 0 errors,
0 warnings.

 net/core/page_pool.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index d7c88c0b67e5..87f14ae855e3 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -274,6 +274,15 @@ static int page_pool_init(struct page_pool *pool,
 
 	if (pool->slow.flags & PP_FLAG_ALLOW_UNREADABLE_NETMEM) {
 		netdev_assert_locked(pool->slow.netdev);
+
+		/* queue_idx indexes dev->_rx[]; reject a value the device
+		 * cannot serve before dereferencing the queue.
+		 */
+		if (pool->slow.queue_idx >= pool->slow.netdev->real_num_rx_queues) {
+			err = -EINVAL;
+			goto free_ptr_ring;
+		}
+
 		rxq = __netif_get_rx_queue(pool->slow.netdev,
 					   pool->slow.queue_idx);
 		pool->mp_priv = rxq->mp_params.mp_priv;