net/sched: fq: clamp quantum and initial_quantum in change path

[ Upstream commit 094cc07f98dfe70a34e2a1923af17fd29b8cf622 ]

The fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and
TCA_FQ_INITIAL_QUANTUM up to INT_MAX, while fq_init() already clamps to
[1, 1<<20]. A user can override the init clamp via tc qdisc change,
restoring the small-quantum deficit spin that the init clamp prevents.

Narrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected at
parse time. Clamp TCA_FQ_QUANTUM to [256, 1<<20] in fq_change() and
fq_init() quantum to [256, 1<<20] for tiny-MTU devices.

Conditions to recreate the bug:
  CONFIG_NET_SCH_FQ=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root fq
  tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 size_log 15 cell_log 0

Fixes: 709f34f7c28d ("net/sched: fq: add overflow bounds to quantum and initial quantum")
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/QDISC-0CFC.v3.20260901204856@mojatatu.com.2
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 9df9c93ae4e4c029b2445ff76a5a75e55cfb31b6..7599a4f7a3e2ad8facf76a03ff323757121fbee5 100644 (file)
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -924,7 +924,7 @@ static int fq_resize(struct Qdisc *sch, u32 log)
 }
 
 static const struct netlink_range_validation iq_range = {
-       .max = INT_MAX,
+       .max = 1 << 20,
 };
 
 static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
@@ -1050,14 +1050,10 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt,
                           nla_get_u32(tb[TCA_FQ_FLOW_PLIMIT]));
 
        if (tb[TCA_FQ_QUANTUM]) {
-               u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
+               u32 quantum = clamp_t(u32, nla_get_u32(tb[TCA_FQ_QUANTUM]),
+                                    256, 1 << 20);
 
-               if (quantum > 0 && quantum <= (1 << 20)) {
-                       WRITE_ONCE(q->quantum, quantum);
-               } else {
-                       NL_SET_ERR_MSG_MOD(extack, "invalid quantum");
-                       err = -EINVAL;
-               }
+               WRITE_ONCE(q->quantum, quantum);
        }
 
        if (tb[TCA_FQ_INITIAL_QUANTUM])
@@ -1176,7 +1172,7 @@ static int fq_init(struct Qdisc *sch, struct nlattr *opt,
        sch->limit              = 10000;
        q->flow_plimit          = 100;
        mtu = clamp_t(u32, psched_mtu(qdisc_dev(sch)), 1, 1 << 20);
-       q->quantum              = min_t(u32, 2 * mtu, 1 << 20);
+       q->quantum              = clamp_t(u32, 2 * mtu, 256, 1 << 20);
        q->initial_quantum      = min_t(u32, 10 * mtu, 1 << 20);
        q->flow_refill_delay    = msecs_to_jiffies(40);
        q->flow_max_rate        = ~0UL;