Eric Dumazet 72fb40d87c llc: fix out-of-bound array index in llc_sk_dev_hash() ... [ Upstream commit 8ac9dfd58b ] Both ifindex and LLC_SK_DEV_HASH_ENTRIES are signed. This means that (ifindex % LLC_SK_DEV_HASH_ENTRIES) is negative if @ifindex is negative. We could simply make LLC_SK_DEV_HASH_ENTRIES unsigned. In this patch I chose to use hash_32() to get more entropy from @ifindex, like llc_sk_laddr_hashfn(). UBSAN: array-index-out-of-bounds in ./include/net/llc.h:75:26 index -43 is out of range for type 'hlist_head [64]' CPU: 1 PID: 20999 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:291 llc_sk_dev_hash include/net/llc.h:75 [inline] llc_sap_add_socket+0x49c/0x520 net/llc/llc_conn.c:697 llc_ui_bind+0x680/0xd70 net/llc/af_llc.c:404 __sys_bind+0x1e9/0x250 net/socket.c:1693 __do_sys_bind net/socket.c:1704 [inline] __se_sys_bind net/socket.c:1702 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1702 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fa503407ae9 Fixes: 6d2e3ea284 ("llc: use a device based hash table to speed up multicast delivery") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-11-18 19:17:10 +01:00
..
acpi	ACPI: tools: fix compilation error	2021-10-07 19:18:19 +02:00
asm-generic	asm-generic: build fixes for v5.15	2021-10-08 11:57:54 -07:00
clocksource
crypto
drm	drm/ttm: remove ttm_bo_vm_insert_huge()	2021-11-18 19:17:08 +01:00
dt-bindings
keys
kunit	kunit: fix kernel-doc warnings due to mismatched arg names	2021-10-06 17:54:07 -06:00
kvm	KVM: arm64: Fix PMU probe ordering	2021-09-20 12:43:34 +01:00
linux	net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge	2021-11-18 19:17:06 +01:00
math-emu
media	media: videobuf2: rework vb2_mem_ops API	2021-11-18 19:16:13 +01:00
memory	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode	2021-11-18 19:16:01 +01:00
misc
net	llc: fix out-of-bound array index in llc_sk_dev_hash()	2021-11-18 19:17:10 +01:00
pcmcia
ras
rdma	RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()	2021-11-18 19:16:52 +01:00
scsi	scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run	2021-11-18 19:15:51 +01:00
soc	net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib	2021-10-12 17:35:18 -07:00
sound	ASoC: topology: Fix stub for snd_soc_tplg_component_remove()	2021-11-18 19:16:55 +01:00
target
trace	block-5.15-2021-10-17	2021-10-17 19:25:20 -10:00
uapi	ethtool: fix ethtool msg len calculation for pause stats	2021-11-18 19:17:06 +01:00
vdso
video
xen	xen/privcmd: drop "pages" parameter from xen_remap_pfn()	2021-10-05 08:20:27 +02:00