linux-kernel - Re: [PATCH net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250723144131.4uuz3zv3nwzy2qfp@skbuf>
Date: Wed, 23 Jul 2025 17:41:31 +0300
From: Vladimir Oltean <vladimir.oltean@....com>
To: Simon Horman <horms@...nel.org>
Cc: Maher Azzouzi <maherazz04@...il.com>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, jhs@...atatu.com,
	xiyou.wangcong@...il.com, jiri@...nulli.us, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	Ferenc Fejes <fejes@....elte.hu>
Subject: Re: [PATCH net] net/sched: mqprio: fix stack out-of-bounds write in
 tc entry parsing

Hi Simon,

On Wed, Jul 23, 2025 at 01:55:21PM +0100, Simon Horman wrote:
> It seems that taprio has a similar problem, but that it is
> not a bug due to an additional check. I wonder if something
> like this for net-next is appropriate to align it's implementation
> wit that of maprio.
> 
> diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
> index 2b14c81a87e5..e759e43ad27e 100644
> --- a/net/sched/sch_taprio.c
> +++ b/net/sched/sch_taprio.c
> @@ -998,7 +998,7 @@ static const struct nla_policy entry_policy[TCA_TAPRIO_SCHED_ENTRY_MAX + 1] = {
>  
>  static const struct nla_policy taprio_tc_policy[TCA_TAPRIO_TC_ENTRY_MAX + 1] = {
>  	[TCA_TAPRIO_TC_ENTRY_INDEX]	   = NLA_POLICY_MAX(NLA_U32,
> -							    TC_QOPT_MAX_QUEUE),
> +							    TC_QOPT_MAX_QUEUE - 1),
>  	[TCA_TAPRIO_TC_ENTRY_MAX_SDU]	   = { .type = NLA_U32 },
>  	[TCA_TAPRIO_TC_ENTRY_FP]	   = NLA_POLICY_RANGE(NLA_U32,
>  							      TC_FP_EXPRESS,
> @@ -1698,19 +1698,15 @@ static int taprio_parse_tc_entry(struct Qdisc *sch,
>  	if (err < 0)
>  		return err;
>  
> -	if (!tb[TCA_TAPRIO_TC_ENTRY_INDEX]) {
> +	if (NL_REQ_ATTR_CHECK(extack, opt, tb, TCA_TAPRIO_TC_ENTRY_INDEX)) {
>  		NL_SET_ERR_MSG_MOD(extack, "TC entry index missing");
>  		return -EINVAL;
>  	}
>  
>  	tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]);
> -	if (tc >= TC_QOPT_MAX_QUEUE) {
> -		NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range");
> -		return -ERANGE;
> -	}
> -
>  	if (*seen_tcs & BIT(tc)) {
> -		NL_SET_ERR_MSG_MOD(extack, "Duplicate TC entry");
> +		NL_SET_ERR_MSG_ATTR(extack, tb[TCA_TAPRIO_TC_ENTRY_INDEX],
> +				    "Duplicate tc entry");
>  		return -EINVAL;
>  	}

Yes, this is net-next material, and you can submit it independently of
the taprio change (i.e. right away).