]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: mac80211: fix integer overflow in hwmp_route_info_get()
authorGavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Wed, 12 Feb 2025 08:21:25 +0000 (08:21 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 25 Apr 2025 08:43:39 +0000 (10:43 +0200)
commit43736338e370db26c8d864e4770ba378081dae1f
tree88c6697ab1b4a8fce245418da5173914a10d96b0
parent5862c312f56d040369049fcf68a4743044725614
wifi: mac80211: fix integer overflow in hwmp_route_info_get()

commit d00c0c4105e5ab8a6a13ed23d701cceb285761fa upstream.

Since the new_metric and last_hop_metric variables can reach
the MAX_METRIC(0xffffffff) value, an integer overflow may occur
when multiplying them by 10/9. It can lead to incorrect behavior.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: a8d418d9ac25 ("mac80211: mesh: only switch path when new metric is at least 10% better")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Link: https://patch.msgid.link/20250212082124.4078236-1-Ilia.Gavrilov@infotecs.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/mac80211/mesh_hwmp.c