Maher Azzouzi d00e412568 net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing ...

[ Upstream commit ffd2dc4c6c ]

TCA_MQPRIO_TC_ENTRY_INDEX is validated using
NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
write in the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

Fixes: f62af20bed ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Maher Azzouzi <maherazz04@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250802001857.2702497-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-08-15 12:14:07 +02:00

..

act_api.c

net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers

2024-10-23 11:31:27 +02:00

act_bpf.c

…

act_connmark.c

…

act_csum.c

…

act_ct.c

…

act_ctinfo.c

net_sched: act_ctinfo: use atomic64_t for three counters

2025-08-15 12:13:43 +02:00

act_gact.c

…

act_gate.c

…

act_ife.c

…

act_meta_mark.c

…

act_meta_skbprio.c

…

act_meta_skbtcindex.c

…

act_mirred.c

…

act_mpls.c

…

act_nat.c

…

act_pedit.c

…

act_police.c

…

act_sample.c

…

act_simple.c

…

act_skbedit.c

…

act_skbmod.c

…

act_tunnel_key.c

net: fix geneve_opt length integer overflow

2025-04-10 14:39:34 +02:00

act_vlan.c

…

cls_api.c

tc: Ensure we have enough buffer space when sending filter netlink notifications

2025-04-20 10:15:07 +02:00

cls_basic.c

…

cls_bpf.c

net: sched: refine software bypass handling in tc_run

2025-02-08 09:57:25 +01:00

cls_cgroup.c

…

cls_flow.c

net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

2025-01-17 13:40:37 +01:00

cls_flower.c

net: fix geneve_opt length integer overflow

2025-04-10 14:39:34 +02:00

cls_fw.c

…

cls_matchall.c

net: sched: refine software bypass handling in tc_run

2025-02-08 09:57:25 +01:00

cls_route.c

…

cls_u32.c

net: sched: refine software bypass handling in tc_run

2025-02-08 09:57:25 +01:00

em_canid.c

…

em_cmp.c

…

em_ipset.c

…

em_ipt.c

…

em_meta.c

…

em_nbyte.c

…

em_text.c

…

em_u32.c

…

ematch.c

…

Kconfig

…

Makefile

…

sch_api.c

net/sched: Abort __tc_modify_qdisc if parent class does not exist

2025-07-17 18:37:07 +02:00

sch_blackhole.c

…

sch_cake.c

sched: sch_cake: add bounds checks to host bulk flow fairness counts

2025-01-17 13:40:41 +01:00

sch_cbs.c

net/sched: cbs: Fix integer overflow in cbs_set_port_rate()

2024-12-14 20:03:47 +01:00

sch_choke.c

net: sched: fix ordering of qlen adjustment

2024-12-27 14:01:57 +01:00

sch_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_drr.c

sch_drr: make drr_qlen_notify() idempotent

2025-05-09 09:50:50 +02:00

sch_etf.c

…

sch_ets.c

net_sched: ets: fix a race in ets_qdisc_change()

2025-06-19 15:32:31 +02:00

sch_fifo.c

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

2025-02-17 10:05:01 +01:00

sch_fq_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_fq_pie.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_fq.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_frag.c

…

sch_generic.c

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

2025-02-08 09:57:07 +01:00

sch_gred.c

sched: address a potential NULL pointer dereference in the GRED scheduler.

2025-03-22 12:54:10 -07:00

sch_hfsc.c

net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

2025-06-04 14:43:51 +02:00

sch_hhf.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_htb.c

net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

2025-07-24 08:56:35 +02:00

sch_ingress.c

…

sch_mq.c

…

sch_mqprio_lib.c

…

sch_mqprio_lib.h

…

sch_mqprio.c

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

2025-08-15 12:14:07 +02:00

sch_multiq.c

…

sch_netem.c

net/sched: Restrict conditions for adding duplicating netems to qdisc tree

2025-08-15 12:13:43 +02:00

sch_pie.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:29:39 +02:00

sch_plug.c

…

sch_prio.c

net_sched: prio: fix a race in prio_tune()

2025-06-19 15:32:31 +02:00

sch_qfq.c

net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class

2025-08-01 09:48:41 +01:00

sch_red.c

net_sched: red: fix a race in __red_change()

2025-06-19 15:32:31 +02:00

sch_sfb.c

…

sch_sfq.c

net_sched: sch_sfq: reject invalid perturb period

2025-06-27 11:11:38 +01:00

sch_skbprio.c

net_sched: skbprio: Remove overly strict queue assertions

2025-04-10 14:39:33 +02:00

sch_taprio.c

net/sched: taprio: enforce minimum value for picos_per_byte

2025-08-15 12:14:06 +02:00

sch_tbf.c

net_sched: tbf: fix a race in tbf_change()

2025-06-19 15:32:31 +02:00

sch_teql.c

…