Commit 1365d7de authored by Chuck Lever's avatar Chuck Lever Committed by Liu Jian
Browse files

svcrdma: Address an integer overflow 

stable inclusion
from stable-v6.6.64
commit 838dd342962cef4c320632a5af48d3c31f2f9877
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGF
CVE: CVE-2024-53151

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=838dd342962cef4c320632a5af48d3c31f2f9877



-------------------------------------------------

[ Upstream commit 3c63d8946e578663b868cb9912dac616ea68bfd0 ]

Dan Carpenter reports:
> Commit 78147ca8 ("svcrdma: Add a "parsed chunk list" data
> structure") from Jun 22, 2020 (linux-next), leads to the following
> Smatch static checker warning:
>
>	net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
>	warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
>     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
>     489 {
>     490         u32 segcount;
>     491         __be32 *p;
>     492
>     493         if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
>                                                               ^^^^^^^^
>
>     494                 return false;
>     495
>     496         /* A bogus segcount causes this buffer overflow check to fail. */
>     497         p = xdr_inline_decode(&rctxt->rc_stream,
> --> 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));
>
>
> segcount is an untrusted u32.  On 32bit systems anything >= SIZE_MAX / 16 will
> have an integer overflow and some those values will be accepted by
> xdr_inline_decode().

Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Fixes: 78147ca8 ("svcrdma: Add a "parsed chunk list" data structure")
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent e53a23ef

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

+7 −1
Original line number Diff line number Diff line
@@ -478,7 +478,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) 
	if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))

		return false;



	/* A bogus segcount causes this buffer overflow check to fail. */

	/* Before trusting the segcount value enough to use it in

	 * a computation, perform a simple range check. This is an

	 * arbitrary but sensible limit (ie, not architectural).

	 */

	if (unlikely(segcount > RPCSVC_MAXPAGES))

		return false;



	p = xdr_inline_decode(&rctxt->rc_stream,

			      segcount * rpcrdma_segment_maxsz * sizeof(*p));

	return p != NULL;