diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-05-10 12:29:02 -0700 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-05-12 16:15:00 +0200 |
| commit | 8d5806c600fddb907ebe378f9c366d4b52ac3a39 (patch) | |
| tree | bcd14a27b4bb8a353790be06da07c43a4fcdf7e2 /Documentation | |
| parent | fbf5df34a4dbcd09d433dd4f0916bf9b2ddb16de (diff) | |
net: shaper: reject handle IDs exceeding internal bit-width
net_shaper_parse_handle() reads the user-supplied handle ID via
nla_get_u32(), accepting the full u32 range. However, the xarray key
is built by net_shaper_handle_to_index() using
FIELD_PREP(NET_SHAPER_ID_MASK, handle->id), where NET_SHAPER_ID_MASK
is GENMASK(25, 0) - only 26 bits wide. FIELD_PREP silently masks off
the upper bits at runtime. A user-supplied NODE id like 0x04000123
becomes id 0x123.
Additionally, a user-supplied id equal to NET_SHAPER_ID_UNSPEC
(0x03FFFFFF, which is NET_SHAPER_ID_MASK itself) would collide with
the sentinel used internally by the group operation to signal
"allocate a new NODE id".
Reject user-supplied IDs >= NET_SHAPER_ID_MASK (i.e., >= 0x03FFFFFF)
in the policy.
Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Link: https://patch.msgid.link/20260510192904.3987113-9-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/netlink/specs/net_shaper.yaml | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Documentation/netlink/specs/net_shaper.yaml b/Documentation/netlink/specs/net_shaper.yaml index 3f2ad772b64b..de01f922040a 100644 --- a/Documentation/netlink/specs/net_shaper.yaml +++ b/Documentation/netlink/specs/net_shaper.yaml @@ -34,6 +34,11 @@ doc: | definitions: - + type: const + name: max-handle-id + value: 0x3fffffe + scope: kernel + - type: enum name: scope doc: Defines the shaper @id interpretation. @@ -140,6 +145,8 @@ attribute-sets: - name: id type: u32 + checks: + max: max-handle-id doc: | Numeric identifier of a shaper. The id semantic depends on the scope. For @queue scope it's the queue id and for @node |