From nobody Mon Sep 28 09:59:13 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1940D18DB01 for ; Mon, 24 Aug 2026 02:46:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787539591; cv=none; b=gNnAm9Sy31IGCe3IWO5WWf/k5+hp1aTQz6jFr+3QPb2sa874+VqCEqw1eEsREpiiD4DIFYnWwy8AkjEjUsUM9Y7VMvG8ybvJlAOxiffGJGMpWftDWOggLYpzPcJNeQbhHwE2bN5g5sGUNiYNZEbpolKadC8OId8E1D9RSG4dVcA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787539591; c=relaxed/simple; bh=6wHJp5jWLPXyCPbYYK7srf8P7Lk/x3nahhhtNbm1rOc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=WMWS4JHHEbW1qimUu3kqJjZc/yaY3Nw8i94Z4r4gsXcVNSTDt0Kpqti5fqtSQM583chR32ZUCs1udyJ0qXaVM+LYOxRioNjhW5ibU3JLsS0gsj4Prnw/g4bjTgPF4hcgX5BNdKkcovWoLY4fpxxOGGKr4RdE1w6k6K0rfARUE9I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=tHwzdLUG; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="tHwzdLUG" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso4081125a91.2 for ; Sun, 23 Aug 2026 19:46:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787539589; x=1788144389; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JdXAVtfWW5XJfHD/rPxea3ZWIOeQzMPQX3bPL/2GZJM=; b=tHwzdLUGkEuymfGBZd0yUkMv9ICFDKDT/V2s5F2wZ0XOQN/ujIIXDGZp+v6hlLPr6c BkqlIlw5O7abckrZ4/bqWLVcjQpspOlzfje5uqkGoXhMXeRBu3sTr2skr2qCeLlN2D2w udlCwEKwK/TJoQZC9H/uon8315p+Qq6ZkElrOy2TnqbQ+Zhe6KBcfYIU47JoM8CYRKKs f0i5zpELEbBo37AJ006EXlC5n8fX6Ha4FzyBi29AKDxCEwJGptDfqRv243TEW+nS4Se6 lAjGB9xG9mQLT/vZ3AO9XvK/VH61eix1/M2YBMGnkyQurUndIGXsZt74h1rrHpuStz4R 1J6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787539589; x=1788144389; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JdXAVtfWW5XJfHD/rPxea3ZWIOeQzMPQX3bPL/2GZJM=; b=OvjCNEwNPwHBX827NhtIF2zllrmjvRk90ZEQFcqFtqyeYvZCMpXKMyAFEbyDW64ILr jAz/n5cV8dntQH68IBD1FDf5bf5TO5SLxd9fkjgN5JdpxURlhYKP0OD6WuvlcmOtSHm6 5tAusU+GLlcBt/nbWv6UcFpfK4dM0Rt6FiOlD/fUyhKyKu2McivAuAMdSLN3nRg46oy9 de3nYFfYNcVWEXRe9TBwj9pT47wmphDWwDDfUSHTpJeM699ZbHPIpAzAhZQ9b4RtUkd8 DaRtppNiFP5EwCgSGxvo1XhNKRdi1084YeWWecJgotASSlQOM1df2AeNRI6fMt2EpAJX Je/g== X-Forwarded-Encrypted: i=1; AHgh+RrH9atv/DNJKMuhd5bFMtxxRY7qhTVQyrNhljjtVlaWY6QNsPU11ewKxq+vJ2fAg3uVum9oL1KioUIDAGw=@vger.kernel.org X-Gm-Message-State: AFuF++mOuYyrXoc1MxV+hFAUNcGzTx9f2Ff27dHfuKEO5Kaco3ljaWhe Ya2/xaui1MqXCAmRkZOls3OsYYAG6y5nbxlbMt67h1BRTytlfAEeCplz X-Gm-Gg: AR+sD10BEmuiE/4GThjTwjEKPiby6/1+tsoTHmsDb1On/xj/ZJEHWen/JQKrrn0V2zn hK04c/Vc+dnDwqEYPfDoI82J6ozKxd3Xd3SULdyyu6dD1uKQKkDp51UqumPMowJDzrcWlRXhATb ReY00cC4SleAxp0bosaQAsUTRQ8kcCREg4Nb6z2u8euiM54k7PQubjJ5/hJSGVmuQbCtNClPthD sS+sl7E3cKMiYXcqLae7GwktjYtuVRDMOGrQQxnrGLN10AWr6hNH4QLzPm0hclZG0nolIEMUcE7 GjXOlHaJwcg8TkujChQLynQWNl3g0yDB/4iRExNSusBylAOZKX7U4ZXQX74Wg8WbcvCxleLAyvN dzawRo/wq85h83HMPfWzgTSc8CA9tjSdU14dOzzdHQXDZf/1EUPk20HdUBIwgG0htwf69EvnXlf T7RBVu3xZfJT9yBfncUO4sy5EMzkpWLKE5YzSWaQkPi6AjGmOubcCjnww29zPnrJ0ISGFwVrCP6 nZjHQ2qVuZW36ZKbMCYbWw= X-Received: by 2002:a17:90b:2e8f:b0:381:e74f:8a6a with SMTP id 98e67ed59e1d1-395c3abee54mr41014455a91.16.1787539589306; Sun, 23 Aug 2026 19:46:29 -0700 (PDT) Received: from deepanshu.. ([2405:201:682f:383f:4cf4:9e7a:69d:2900]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90e22f8sm18744195eec.13.2026.08.23.19.46.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 23 Aug 2026 19:46:28 -0700 (PDT) From: Deepanshu Kartikey To: 3chas3@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org Cc: linux-atm-general@lists.sourceforge.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com Subject: [PATCH] net: atm: fix shift-out-of-bounds in __vcc_connect() Date: Mon, 24 Aug 2026 08:16:20 +0530 Message-Id: <20260824024620.23485-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dev->ci_range.vpi_bits and vci_bits can legitimately be ATM_CI_MAX (-1), a sentinel meaning "no range configured, use maximum" (see include/uapi/linux/atmdev.h). Some drivers, such as usbatm_atm_init() in drivers/usb/atm/usbatm.c, set this sentinel and never resolve it to an actual bit width. __vcc_connect() uses these fields directly as a shift amount without checking for the sentinel, so binding a PVC socket on such a device triggers a negative shift: UBSAN: shift-out-of-bounds in net/atm/common.c:381:10 shift exponent -1 is negative Skip the range check when ci_range.vpi_bits/vci_bits is still ATM_CI_MAX, since that value means "unrestricted". Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D6665d3db5fef15914802 Tested-by: syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- net/atm/common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/atm/common.c b/net/atm/common.c index 81195727fa18..73057bb016f7 100644 --- a/net/atm/common.c +++ b/net/atm/common.c @@ -378,8 +378,11 @@ static int __vcc_connect(struct atm_vcc *vcc, struct a= tm_dev *dev, short vpi, int error; =20 if ((vpi !=3D ATM_VPI_UNSPEC && vpi !=3D ATM_VPI_ANY && + dev->ci_range.vpi_bits !=3D ATM_CI_MAX && vpi >> dev->ci_range.vpi_bits) || (vci !=3D ATM_VCI_UNSPEC && - vci !=3D ATM_VCI_ANY && vci >> dev->ci_range.vci_bits)) + vci !=3D ATM_VCI_ANY && + dev->ci_range.vci_bits !=3D ATM_CI_MAX && + vci >> dev->ci_range.vci_bits)) return -EINVAL; if (vci > 0 && vci < ATM_NOT_RSV_VCI && !capable(CAP_NET_BIND_SERVICE)) return -EPERM; --=20 2.34.1