Re: [PATCH v2 net] net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

[Eric Dumazet]

On Tue, Jul 29, 2025 at 8:36 AM maher azz <maherazz04@xxxxxxxxx> wrote:
>
> From: Maher Azzouzi <maherazz04@xxxxxxxxx>
>
> TCA_MQPRIO_TC_ENTRY_INDEX is validated using
> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in
> the fp[] array, which only has room for 16 elements (0–15).
>
> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
>
> Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
>
> Signed-off-by: Maher Azzouzi <maherazz04@xxxxxxxxx>
>

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>