Commit ee47a5cb authored by Yuli Wang's avatar Yuli Wang Committed by Jinjie Ruan
Browse files

LoongArch: csum: Fix OoB access in IP checksum code for negative lengths 

stable inclusion
from stable-v6.6.79
commit 964a8895704a22efc06a2a3276b624a5ae985a06
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4E
CVE: CVE-2025-21789

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=964a8895704a22efc06a2a3276b624a5ae985a06



--------------------------------

[ Upstream commit 6287f1a8c16138c2ec750953e35039634018c84a ]

Commit 69e3a6aa ("LoongArch: Add checksum optimization for 64-bit
system") would cause an undefined shift and an out-of-bounds read.

Commit 8bd795fe ("arm64: csum: Fix OoB access in IP checksum code
for negative lengths") fixes the same issue on ARM64.

Fixes: 69e3a6aa ("LoongArch: Add checksum optimization for 64-bit system")
Co-developed-by: default avatarWentao Guan <guanwentao@uniontech.com>
Signed-off-by: default avatarWentao Guan <guanwentao@uniontech.com>
Signed-off-by: default avatarYuli Wang <wangyuli@uniontech.com>
Signed-off-by: default avatarHuacai Chen <chenhuacai@loongson.cn>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarJinjie Ruan <ruanjinjie@huawei.com>
parent 9d22d5b7

arch/loongarch/lib/csum.c

+1 −1
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len) 
	const u64 *ptr;

	u64 data, sum64 = 0;



	if (unlikely(len == 0))

	if (unlikely(len <= 0))

		return 0;



	offset = (unsigned long)buff & 7;