From 1a5263677a9f8d6b6b94c3ba6a71998401cef6ed Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 21 Jul 2023 17:23:44 +0200 Subject: [PATCH] 5.10-stable patches added patches: net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch --- ...reintroduce-lmax-bound-check-for-mtu.patch | 47 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 48 insertions(+) create mode 100644 queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch diff --git a/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch b/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch new file mode 100644 index 00000000000..ec990f6a959 --- /dev/null +++ b/queue-5.10/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch @@ -0,0 +1,47 @@ +From 158810b261d02fc7dd92ca9c392d8f8a211a2401 Mon Sep 17 00:00:00 2001 +From: Pedro Tammela +Date: Tue, 11 Jul 2023 18:01:00 -0300 +Subject: net/sched: sch_qfq: reintroduce lmax bound check for MTU + +From: Pedro Tammela + +commit 158810b261d02fc7dd92ca9c392d8f8a211a2401 upstream. + +25369891fcef deletes a check for the case where no 'lmax' is +specified which 3037933448f6 previously fixed as 'lmax' +could be set to the device's MTU without any bound checking +for QFQ_LMAX_MIN and QFQ_LMAX_MAX. Therefore, reintroduce the check. + +Fixes: 25369891fcef ("net/sched: sch_qfq: refactor parsing of netlink parameters") +Acked-by: Jamal Hadi Salim +Reviewed-by: Eric Dumazet +Signed-off-by: Pedro Tammela +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_qfq.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -428,10 +428,17 @@ static int qfq_change_class(struct Qdisc + else + weight = 1; + +- if (tb[TCA_QFQ_LMAX]) ++ if (tb[TCA_QFQ_LMAX]) { + lmax = nla_get_u32(tb[TCA_QFQ_LMAX]); +- else ++ } else { ++ /* MTU size is user controlled */ + lmax = psched_mtu(qdisc_dev(sch)); ++ if (lmax < QFQ_MIN_LMAX || lmax > QFQ_MAX_LMAX) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "MTU size out of bounds for qfq"); ++ return -EINVAL; ++ } ++ } + + inv_w = ONE_FP / weight; + weight = ONE_FP / inv_w; diff --git a/queue-5.10/series b/queue-5.10/series index 1d5dac67526..da96c5eb0a9 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -436,3 +436,4 @@ scsi-qla2xxx-check-valid-rport-returned-by-fc_bsg_to_rport.patch scsi-qla2xxx-correct-the-index-of-array.patch scsi-qla2xxx-pointer-may-be-dereferenced.patch scsi-qla2xxx-remove-unused-nvme_ls_waitq-wait-queue.patch +net-sched-sch_qfq-reintroduce-lmax-bound-check-for-mtu.patch -- 2.47.3