hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' When vif_delete() is called with vifi = -2147483648 (INT_MIN), the operation "vifi - 1" causes a signed integer overflow, which is undefined behavior in C. This occurs because the function does not validate the vifi range before using it as an array index. Fix by adding a proper range check at the beginning of vif_delete() to ensure vifi falls within [0, maxvif) before any arithmetic operation is performed. This prevents the overflow and eliminates the UBSAN warning. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370e..acf60f0a01a4a 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8