Patch "virtio_net: fix integer overflow in stats" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    virtio_net: fix integer overflow in stats

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     virtio_net-fix-integer-overflow-in-stats.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0de0fda01c0630eab5d4475912081495f45cbdad
Author: Michael S. Tsirkin <mst@xxxxxxxxxx>
Date:   Wed Oct 16 13:27:07 2024 -0400

    virtio_net: fix integer overflow in stats
    
    [ Upstream commit d95d9a31aceb2021084bc9b94647bc5b175e05e7 ]
    
    Static analysis on linux-next has detected the following issue
    in function virtnet_stats_ctx_init, in drivers/net/virtio_net.c :
    
            if (vi->device_stats_cap & VIRTIO_NET_STATS_TYPE_CVQ) {
                    queue_type = VIRTNET_Q_TYPE_CQ;
                    ctx->bitmap[queue_type]   |= VIRTIO_NET_STATS_TYPE_CVQ;
                    ctx->desc_num[queue_type] += ARRAY_SIZE(virtnet_stats_cvq_desc);
                    ctx->size[queue_type]     += sizeof(struct virtio_net_stats_cvq);
            }
    
    ctx->bitmap is declared as a u32 however it is being bit-wise or'd with
    VIRTIO_NET_STATS_TYPE_CVQ and this is defined as 1 << 32:
    
    include/uapi/linux/virtio_net.h:#define VIRTIO_NET_STATS_TYPE_CVQ (1ULL << 32)
    
    ..and hence the bit-wise or operation won't set any bits in ctx->bitmap
    because 1ULL < 32 is too wide for a u32.
    
    In fact, the field is read into a u64:
    
           u64 offset, bitmap;
    ....
           bitmap = ctx->bitmap[queue_type];
    
    so to fix, it is enough to make bitmap an array of u64.
    
    Fixes: 941168f8b40e5 ("virtio_net: support device stats")
    Reported-by: "Colin King (gmail)" <colin.i.king@xxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
    Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
    Link: https://patch.msgid.link/53e2bd6728136d5916e384a7840e5dc7eebff832.1729099611.git.mst@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f8131f92a3928..792e9eadbfc3d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -4155,7 +4155,7 @@ struct virtnet_stats_ctx {
 	u32 desc_num[3];
 
 	/* The actual supported stat types. */
-	u32 bitmap[3];
+	u64 bitmap[3];
 
 	/* Used to calculate the reply buffer size. */
 	u32 size[3];