5.10-stable patches

added patches:
	net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch

diff --git a/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch b/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch
new file mode 100644 (file)
index 0000000..ec990f6
--- /dev/null
+++ b/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch
@@ -0,0 +1,47 @@
+From 158810b261d02fc7dd92ca9c392d8f8a211a2401 Mon Sep 17 00:00:00 2001
+From: Pedro Tammela <pctammela@mojatatu.com>
+Date: Tue, 11 Jul 2023 18:01:00 -0300
+Subject: net/sched: sch_qfq: reintroduce lmax bound check for MTU
+
+From: Pedro Tammela <pctammela@mojatatu.com>
+
+commit 158810b261d02fc7dd92ca9c392d8f8a211a2401 upstream.
+
+25369891fcef deletes a check for the case where no 'lmax' is
+specified which 3037933448f6 previously fixed as 'lmax'
+could be set to the device's MTU without any bound checking
+for QFQ_LMAX_MIN and QFQ_LMAX_MAX. Therefore, reintroduce the check.
+
+Fixes: 25369891fcef ("net/sched: sch_qfq: refactor parsing of netlink parameters")
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_qfq.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -428,10 +428,17 @@ static int qfq_change_class(struct Qdisc
+       else
+               weight = 1;
+ 
+-      if (tb[TCA_QFQ_LMAX])
++      if (tb[TCA_QFQ_LMAX]) {
+               lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
+-      else
++      } else {
++              /* MTU size is user controlled */
+               lmax = psched_mtu(qdisc_dev(sch));
++              if (lmax < QFQ_MIN_LMAX || lmax > QFQ_MAX_LMAX) {
++                      NL_SET_ERR_MSG_MOD(extack,
++                                         "MTU size out of bounds for qfq");
++                      return -EINVAL;
++              }
++      }
+ 
+       inv_w = ONE_FP / weight;
+       weight = ONE_FP / inv_w;

diff --git a/queue-5.10/series b/queue-5.10/series
index 1d5dac67526d033ba57208568244754dda1c4067..da96c5eb0a96cbc23bc4331b4ebc1f7f6f3c77bb 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -436,3 +436,4 @@ scsi-qla2xxx-check-valid-rport-returned-by-fc_bsg_to_rport.patch
 scsi-qla2xxx-correct-the-index-of-array.patch
 scsi-qla2xxx-pointer-may-be-dereferenced.patch
 scsi-qla2xxx-remove-unused-nvme_ls_waitq-wait-queue.patch
+net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch