Re: [PATCH net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Vladimir Oltean]

Hi Simon,

On Wed, Jul 23, 2025 at 01:55:21PM +0100, Simon Horman wrote:
> It seems that taprio has a similar problem, but that it is
> not a bug due to an additional check. I wonder if something
> like this for net-next is appropriate to align it's implementation
> wit that of maprio.
> 
> diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
> index 2b14c81a87e5..e759e43ad27e 100644
> --- a/net/sched/sch_taprio.c
> +++ b/net/sched/sch_taprio.c
> @@ -998,7 +998,7 @@ static const struct nla_policy entry_policy[TCA_TAPRIO_SCHED_ENTRY_MAX + 1] = {
>  
>  static const struct nla_policy taprio_tc_policy[TCA_TAPRIO_TC_ENTRY_MAX + 1] = {
>  	[TCA_TAPRIO_TC_ENTRY_INDEX]	   = NLA_POLICY_MAX(NLA_U32,
> -							    TC_QOPT_MAX_QUEUE),
> +							    TC_QOPT_MAX_QUEUE - 1),
>  	[TCA_TAPRIO_TC_ENTRY_MAX_SDU]	   = { .type = NLA_U32 },
>  	[TCA_TAPRIO_TC_ENTRY_FP]	   = NLA_POLICY_RANGE(NLA_U32,
>  							      TC_FP_EXPRESS,
> @@ -1698,19 +1698,15 @@ static int taprio_parse_tc_entry(struct Qdisc *sch,
>  	if (err < 0)
>  		return err;
>  
> -	if (!tb[TCA_TAPRIO_TC_ENTRY_INDEX]) {
> +	if (NL_REQ_ATTR_CHECK(extack, opt, tb, TCA_TAPRIO_TC_ENTRY_INDEX)) {
>  		NL_SET_ERR_MSG_MOD(extack, "TC entry index missing");
>  		return -EINVAL;
>  	}
>  
>  	tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]);
> -	if (tc >= TC_QOPT_MAX_QUEUE) {
> -		NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range");
> -		return -ERANGE;
> -	}
> -
>  	if (*seen_tcs & BIT(tc)) {
> -		NL_SET_ERR_MSG_MOD(extack, "Duplicate TC entry");
> +		NL_SET_ERR_MSG_ATTR(extack, tb[TCA_TAPRIO_TC_ENTRY_INDEX],
> +				    "Duplicate tc entry");
>  		return -EINVAL;
>  	}

Yes, this is net-next material, and you can submit it independently of
the taprio change (i.e. right away).