From 166c3566aacda0508914036d649f102837ab9c39 Mon Sep 17 00:00:00 2001 From: Gavrilov Ilia Date: Thu, 17 Jul 2025 19:52:53 +0800 Subject: [PATCH] xsk: fix an integer overflow in xp_create_and_assign_umem() stable inclusion from stable-v6.6.85 commit b7b4be1fa43294b50b22e812715198629806678a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFR CVE: CVE-2025-21997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b7b4be1fa43294b50b22e812715198629806678a -------------------------------- commit 559847f56769037e5b2e0474d3dbff985b98083d upstream. Since the i and pool->chunk_size variables are of type u32, their product can wrap around and then be cast to u64. This can lead to two different XDP buffers pointing to the same memory area. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 94033cd8e73b ("xsk: Optimize for aligned case") Cc: stable@vger.kernel.org Signed-off-by: Ilia Gavrilov Link: https://patch.msgid.link/20250313085007.3116044-1-Ilia.Gavrilov@infotecs.ru Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Signed-off-by: Wang Liang --- net/xdp/xsk_buff_pool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c index f38388b6b62c..e83b707da25b 100644 --- a/net/xdp/xsk_buff_pool.c +++ b/net/xdp/xsk_buff_pool.c @@ -104,7 +104,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs, if (pool->unaligned) pool->free_heads[i] = xskb; else - xp_init_xskb_addr(xskb, pool, i * pool->chunk_size); + xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size); } return pool; -- Gitee