diff options
| author | Maher Azzouzi <[email protected]> | 2025-08-02 00:18:57 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2025-08-05 00:22:20 +0000 |
| commit | ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17 (patch) | |
| tree | d7f497ed145936acf1fcde7024a55f080ccf22fe /tools/testing/selftests/net/lib/py/utils.py | |
| parent | Revert "net: mdio_bus: Use devm for getting reset GPIO" (diff) | |
| download | kernel-ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17.tar.gz kernel-ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17.zip | |
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
TCA_MQPRIO_TC_ENTRY_INDEX is validated using
NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value
TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack
write in the fp[] array, which only has room for 16 elements (0–15).
Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus")
Reviewed-by: Eric Dumazet <[email protected]>
Signed-off-by: Maher Azzouzi <[email protected]>
Reviewed-by: Vladimir Oltean <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'tools/testing/selftests/net/lib/py/utils.py')
0 files changed, 0 insertions, 0 deletions