mainline inclusion from mainline-v7.1-rc1 commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- The IPV4_DEVCONF_MC_FORWARDING counter is maintained by the kernel (vif_add/vif_delete), but inet_set_link_af() wrote it without any validation, allowing user space to set it to INT_MIN via RTM_NEWLINK + IFLA_INET_CONF. A following MRT_DEL_VIF then triggers a signed integer overflow in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720 -2147483648 - 1 cannot be represented in type 'int' Backport of upstream commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly"), adapted for 4.19 which lacks NLA_REJECT and NLA_POLICY_RANGE. The upstream NLA_REJECT policy for MC_FORWARDING is equivalently implemented by an explicit check in inet_validate_link_af(). Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370..70cbeacf8257 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8