REG, &umem_reg, sizeof(umem_reg));
       ...

       xsk_ring_prod__reserve(tq, batch_size, &idx);

       for (i = 0; i < nr_packets; ++i) {
               struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
               tx_desc->addr = packets[i].addr;
               tx_desc->addr += umem->tx_metadata_len;
               tx_desc->options = XDP_TX_METADATA;
               tx_desc->len = UINT32_MAX;
       }

       xsk_ring_prod__submit(tq, nr_packets);
       ...
       sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
v2: Add a repro
 net/xdp/xsk_queue.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index f16f390370dc..b206a8839b39 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
 					    struct xdp_desc *desc)
 {
 	u64 addr = desc->addr - pool->tx_metadata_len;
-	u64 len = desc->len + pool->tx_metadata_len;
+	u64 len = (u64)desc->len + pool->tx_metadata_len;
 	u64 offset = addr & (pool->chunk_size - 1);
 
 	if (!desc->len)
@@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
 					      struct xdp_desc *desc)
 {
 	u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;
-	u64 len = desc->len + pool->tx_metadata_len;
+	u64 len = (u64)desc->len + pool->tx_metadata_len;
 
 	if (!desc->len)
 		return false;
-- 
2.39.5[PATCH net v2] xsk: Fix overflow in descriptor validationIlia Gavrilov <Ilia.Gavrilov@infotecs.ru> undefinedMagnus Karlsson <magnus.karlsson@intel.com> undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined‚~ƒ…G
