* [PATCH net] xsk: fix an integer overflow in xp_create_and_assign_umem()
@ 2025-03-13 8:50 Gavrilov Ilia
2025-03-19 22:00 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Gavrilov Ilia @ 2025-03-13 8:50 UTC (permalink / raw)
To: bjorn@kernel.org
Cc: Magnus Karlsson, Maciej Fijalkowski, Jonathan Lemon,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, netdev@vger.kernel.org,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org, stable@vger.kernel.org
Since the i and pool->chunk_size variables are of type 'u32',
their product can wrap around and then be cast to 'u64'.
This can lead to two different XDP buffers pointing to the same
memory area.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: 94033cd8e73b ("xsk: Optimize for aligned case")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
net/xdp/xsk_buff_pool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index 1f7975b49657..d158cb6dd391 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c
@@ -105,7 +105,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs,
if (pool->unaligned)
pool->free_heads[i] = xskb;
else
- xp_init_xskb_addr(xskb, pool, i * pool->chunk_size);
+ xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size);
}
return pool;
--
2.39.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] xsk: fix an integer overflow in xp_create_and_assign_umem()
2025-03-13 8:50 [PATCH net] xsk: fix an integer overflow in xp_create_and_assign_umem() Gavrilov Ilia
@ 2025-03-19 22:00 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-03-19 22:00 UTC (permalink / raw)
To: Gavrilov Ilia
Cc: bjorn, magnus.karlsson, maciej.fijalkowski, jonathan.lemon, davem,
edumazet, kuba, pabeni, horms, ast, daniel, hawk, john.fastabend,
netdev, bpf, linux-kernel, lvc-project, stable
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Thu, 13 Mar 2025 08:50:08 +0000 you wrote:
> Since the i and pool->chunk_size variables are of type 'u32',
> their product can wrap around and then be cast to 'u64'.
> This can lead to two different XDP buffers pointing to the same
> memory area.
>
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
>
> [...]
Here is the summary with links:
- [net] xsk: fix an integer overflow in xp_create_and_assign_umem()
https://git.kernel.org/netdev/net/c/559847f56769
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-03-19 21:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-13 8:50 [PATCH net] xsk: fix an integer overflow in xp_create_and_assign_umem() Gavrilov Ilia
2025-03-19 22:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox