Date:   Sat, 28 Jan 2023 11:29:28 -0800
From:   Cong Wang <xiyou.wangcong@gmail.com>
To:     Kees Cook <keescook@chromium.org>
Cc:     Jamal Hadi Salim <jhs@mojatatu.com>, Jiri Pirko <jiri@resnulli.us>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] net: sched: sch: Bounds check priority
Message-ID: <Y9V3mBmLUcrEdrTV@pop-os.localdomain>
References: <20230127224036.never.561-kees@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230127224036.never.561-kees@kernel.org>
Precedence: bulk

On Fri, Jan 27, 2023 at 02:40:37PM -0800, Kees Cook wrote:
> Nothing was explicitly bounds checking the priority index used to access
> clpriop[]. WARN and bail out early if it's pathological. Seen with GCC 13:
> 
> ../net/sched/sch_htb.c: In function 'htb_activate_prios':
> ../net/sched/sch_htb.c:437:44: warning: array subscript [0, 31] is outside array bounds of 'struct htb_prio[8]' [-Warray-bounds=]
>   437 |                         if (p->inner.clprio[prio].feed.rb_node)
>       |                             ~~~~~~~~~~~~~~~^~~~~~
> ../net/sched/sch_htb.c:131:41: note: while referencing 'clprio'
>   131 |                         struct htb_prio clprio[TC_HTB_NUMPRIO];
>       |                                         ^~~~~~

Reviewed-by: Cong Wang <cong.wang@bytedance.com>

We already have a check in htb_change_class():

2056                 if ((cl->prio = hopt->prio) >= TC_HTB_NUMPRIO)
2057                         cl->prio = TC_HTB_NUMPRIO - 1;

so this patch is just to make GCC 13 happy.

Thanks.