Patch "pktgen: Avoid out-of-bounds access in get_imix_entries" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    pktgen: Avoid out-of-bounds access in get_imix_entries

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     pktgen-avoid-out-of-bounds-access-in-get_imix_entrie.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0c7155030203dc5b6466b1193d127216d340d83f
Author: Artem Chernyshev <artem.chernyshev@xxxxxxxxxxx>
Date:   Thu Jan 9 11:30:39 2025 +0300

    pktgen: Avoid out-of-bounds access in get_imix_entries
    
    [ Upstream commit 76201b5979768500bca362871db66d77cb4c225e ]
    
    Passing a sufficient amount of imix entries leads to invalid access to the
    pkt_dev->imix_entries array because of the incorrect boundary check.
    
    UBSAN: array-index-out-of-bounds in net/core/pktgen.c:874:24
    index 20 is out of range for type 'imix_pkt [20]'
    CPU: 2 PID: 1210 Comm: bash Not tainted 6.10.0-rc1 #121
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
    Call Trace:
    <TASK>
    dump_stack_lvl lib/dump_stack.c:117
    __ubsan_handle_out_of_bounds lib/ubsan.c:429
    get_imix_entries net/core/pktgen.c:874
    pktgen_if_write net/core/pktgen.c:1063
    pde_write fs/proc/inode.c:334
    proc_reg_write fs/proc/inode.c:346
    vfs_write fs/read_write.c:593
    ksys_write fs/read_write.c:644
    do_syscall_64 arch/x86/entry/common.c:83
    entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:130
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 52a62f8603f9 ("pktgen: Parse internet mix (imix) input")
    Signed-off-by: Artem Chernyshev <artem.chernyshev@xxxxxxxxxxx>
    [ fp: allow to fill the array completely; minor changelog cleanup ]
    Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 0e472f6fab853..359e24c3f22ca 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -850,6 +850,9 @@ static ssize_t get_imix_entries(const char __user *buffer,
 		unsigned long weight;
 		unsigned long size;
 
+		if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES)
+			return -E2BIG;
+
 		len = num_arg(&buffer[i], max_digits, &size);
 		if (len < 0)
 			return len;
@@ -879,9 +882,6 @@ static ssize_t get_imix_entries(const char __user *buffer,
 
 		i++;
 		pkt_dev->n_imix_entries++;
-
-		if (pkt_dev->n_imix_entries > MAX_IMIX_ENTRIES)
-			return -E2BIG;
 	} while (c == ' ');
 
 	return i;