]> www.infradead.org Git - users/hch/misc.git/commit
xsk: fix an integer overflow in xp_create_and_assign_umem()
authorGavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Thu, 13 Mar 2025 08:50:08 +0000 (08:50 +0000)
committerPaolo Abeni <pabeni@redhat.com>
Wed, 19 Mar 2025 21:57:04 +0000 (22:57 +0100)
commit559847f56769037e5b2e0474d3dbff985b98083d
tree37e47070cb15e8a4719bb928229dab6c4d0bea47
parenta0aff75e1553913bfbff10ebb372c7dc0971d2dd
xsk: fix an integer overflow in xp_create_and_assign_umem()

Since the i and pool->chunk_size variables are of type 'u32',
their product can wrap around and then be cast to 'u64'.
This can lead to two different XDP buffers pointing to the same
memory area.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: 94033cd8e73b ("xsk: Optimize for aligned case")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Link: https://patch.msgid.link/20250313085007.3116044-1-Ilia.Gavrilov@infotecs.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/xdp/xsk_buff_pool.c