netdev - [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAFQ-Uc-5ucm+Dyt2s4vV5AyJKjamF=7E_wCWFROYubR5E1PMUg@mail.gmail.com>
Date: Tue, 29 Jul 2025 16:39:26 +0100
From: maher azz <maherazz04@...il.com>
To: netdev@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Jamal Hadi Salim <jhs@...atatu.com>, 
	Cong Wang <xiyou.wangcong@...il.com>, jiri@...nulli.us, davem@...emloft.net, 
	Eric Dumazet <edumazet@...gle.com>, kuba@...nel.org, pabeni@...hat.com, 
	Simon Horman <horms@...nel.org>, Ferenc Fejes <fejes@....elte.hu>, 
	Vladimir Oltean <vladimir.oltean@....com>, MaherAzzouzi <maherazz04@...il.com>
Subject: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc
 entry parsing

From: Maher Azzouzi <maherazz04@...il.com>

TCA_MQPRIO_TC_ENTRY_INDEX is validated using
NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in
the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP
adminStatus")

Signed-off-by: Maher Azzouzi <maherazz04@...il.com>
---
 net/sched/sch_mqprio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 51d4013b6121..f3e5ef9a9592 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -152,7 +152,7 @@ static int mqprio_parse_opt(struct net_device
*dev, struct tc_mqprio_qopt *qopt,
 static const struct
 nla_policy mqprio_tc_entry_policy[TCA_MQPRIO_TC_ENTRY_MAX + 1] = {
        [TCA_MQPRIO_TC_ENTRY_INDEX]     = NLA_POLICY_MAX(NLA_U32,
-                                                        TC_QOPT_MAX_QUEUE),
+                                                        TC_QOPT_MAX_QUEUE - 1),
        [TCA_MQPRIO_TC_ENTRY_FP]        = NLA_POLICY_RANGE(NLA_U32,
                                                           TC_FP_EXPRESS,
                                                           TC_FP_PREEMPTIBLE),
--
2.34.1