]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: mac80211: fix integer overflow in hwmp_route_info_get()
authorGavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Wed, 12 Feb 2025 08:21:25 +0000 (08:21 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 2 May 2025 05:44:02 +0000 (07:44 +0200)
commit9ae11b06c5576bd149ae8ac666edb9de38b89531
treea012c7fc702b4031f9808f5a8355d56f95a23c10
parent977fb8126e5c7dc8aeacc92042ce79730b6efa52
wifi: mac80211: fix integer overflow in hwmp_route_info_get()

commit d00c0c4105e5ab8a6a13ed23d701cceb285761fa upstream.

Since the new_metric and last_hop_metric variables can reach
the MAX_METRIC(0xffffffff) value, an integer overflow may occur
when multiplying them by 10/9. It can lead to incorrect behavior.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: a8d418d9ac25 ("mac80211: mesh: only switch path when new metric is at least 10% better")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Link: https://patch.msgid.link/20250212082124.4078236-1-Ilia.Gavrilov@infotecs.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/mac80211/mesh_hwmp.c