Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
daaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 33ec04cadb77605b71d9298311919303d390c4d5affecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 92c81fbb3ed2e0dfc33a4183a67135e1ab566aceaffecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 64f00b4df0597590b199b62a37a165473bf658a6affecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 3b08cfc65f07b1132c1979d73f014ae6e04de55daffecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < a83fdaeaea3677b83a53f72ace2d73a19bcd6d93affecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 8435f0961bf3dc65e204094349bd9aeaac1f8868affecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < d817f0d34d927f2deb17dadbfe212c9a6a32ac3eaffecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < a6fa75b5096c0f9826a4fabe22d907b0a5bb1016affecteddaaf427c6ab392bedcd018e326b2ffa1e1110cd6 to < 6787d916c2cf9850c97a0a3f73e08c43e7d973b1affected
Linux Linux
Default version status: affected
3.19affected0 to < 3.19unaffected4.19.311 to ≤ 4.19.*unaffected5.4.273 to ≤ 5.4.*unaffected5.10.214 to ≤ 5.10.*unaffected5.15.153 to ≤ 5.15.*unaffected6.1.83 to ≤ 6.1.*unaffected6.6.23 to ≤ 6.6.*unaffected6.7.11 to ≤ 6.7.*unaffected6.8.2 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 ↗
- https://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace ↗
- https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 ↗
- https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d ↗
- https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 ↗
- https://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 ↗
- https://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e ↗
- https://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 ↗
- https://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗