Patch "net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 93de6502f4621097bd29a03cdb813cfc0bb84573
Author: Lin Ma <linma@xxxxxxxxxx>
Date:   Tue Jul 25 10:42:27 2023 +0800

    net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
    
    [ Upstream commit 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 ]
    
    The nla_for_each_nested parsing in function mqprio_parse_nlattr() does
    not check the length of the nested attribute. This can lead to an
    out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
    be viewed as 8 byte integer and passed to priv->max_rate/min_rate.
    
    This patch adds the check based on nla_len() when check the nla_type(),
    which ensures that the length of these two attribute must equals
    sizeof(u64).
    
    Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio")
    Reviewed-by: Victor Nogueira <victor@xxxxxxxxxxxx>
    Signed-off-by: Lin Ma <linma@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230725024227.426561-1-linma@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index ab69ff7577fc7..793009f445c03 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -290,6 +290,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
 						    "Attribute type expected to be TCA_MQPRIO_MIN_RATE64");
 				return -EINVAL;
 			}
+
+			if (nla_len(attr) != sizeof(u64)) {
+				NL_SET_ERR_MSG_ATTR(extack, attr,
+						    "Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length");
+				return -EINVAL;
+			}
+
 			if (i >= qopt->num_tc)
 				break;
 			priv->min_rate[i] = nla_get_u64(attr);
@@ -312,6 +319,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
 						    "Attribute type expected to be TCA_MQPRIO_MAX_RATE64");
 				return -EINVAL;
 			}
+
+			if (nla_len(attr) != sizeof(u64)) {
+				NL_SET_ERR_MSG_ATTR(extack, attr,
+						    "Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length");
+				return -EINVAL;
+			}
+
 			if (i >= qopt->num_tc)
 				break;
 			priv->max_rate[i] = nla_get_u64(attr);