hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' When vif_delete() is called with vifi = -2147483648 (INT_MIN), the operation "vifi - 1" causes a signed integer overflow, which is undefined behavior in C. This occurs because the function does not validate the vifi range before using it as an array index. Fix by adding a proper range check at the beginning of vif_delete() to ensure vifi falls within [0, maxvif) before any arithmetic operation is performed. This prevents the overflow and eliminates the UBSAN warning. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> Therefore, this self-developed adaptation adopts an equivalent manual validation approach: add checks for key attributes in inet_validate_link_af(), reject read-only attributes (e.g., mc_forwarding) by returning -EINVAL, preventing them from being modified via netlink. This approach aligns with the upstream fix's objective, does not introduce additional kernel ABI changes, and has no impact on existing netlink users. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370e..acf60f0a01a4a 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8