[BUG] net/sched: cls_bpf queue_mapping can index past dev->_tx

Hello,

A BPF_PROG_TYPE_SCHED_CLS filter attached to a transmit prio qdisc writes queue_mapping=4 on a four-queue device. qdisc_restart() later trusts the rewritten value and indexes dev->_tx[4].

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/78f9a35aefa28e146789cafa359f4503/raw/7e7d944d129639cd162492ae1881a47e29fbd68b/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/78f9a35aefa28e146789cafa359f4503/raw/92563268a50ce92ae4eef3789c52dec7666d0fc8/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/78f9a35aefa28e146789cafa359f4503/raw/828b0ecf003bf52edc7b49af429dbeca013b044d/poc.c

Build the tested kernel with the attached configuration, including CONFIG_DEBUG_NET and KASAN for the recorded oracles. Compile poc.c statically and run it in a disposable VM with the capabilities noted above. The positive mode uses an out-of-range mapping; the control uses mapping 1.

Impact and prerequisites:
The four-queue test reaches an out-of-bounds netdev_queue access. CONFIG_DEBUG_NET reports the invalid index and KASAN reports an 8-byte read past the 1280-byte queue allocation. The PoC needs CAP_BPF or CAP_SYS_ADMIN in the initial user namespace, plus CAP_NET_ADMIN and CAP_NET_RAW. This is a privileged memory-safety bug; no privilege escalation is demonstrated.

Validation: Two independent fresh-boot positives and a packaged recheck reproduced the warning; an in-range mapping control was clean. KASAN corroboration is included.

Thanks,

shaos