Commit ddaf826e authored Feb 07, 2025 by Guangguan Wang Committed by Wang Liang Feb 07, 2025

net/smc: check smcd_v2_ext_offset when receiving proposal msg

stable inclusion
from stable-v6.6.68
commit 935caf324b445fe73d7708fae6f7176fb243f357
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC6V
CVE: CVE-2024-47408

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=935caf324b445fe73d7708fae6f7176fb243f357



--------------------------------

[ Upstream commit 9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad ]

When receiving proposal msg in server, the field smcd_v2_ext_offset in
proposal msg is from the remote client and can not be fully trusted.
Once the value of smcd_v2_ext_offset exceed the max value, there has
the chance to access wrong address, and crash may happen.

This patch checks the value of smcd_v2_ext_offset before using it.

Fixes: 5c21c4cc ("net/smc: determine accepted ISM devices")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Wang Liang <wangliang74@huawei.com>

parent f8c09dd6

net/smc/af_smc.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -2153,6 +2153,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc,
		pclc_smcd = smc_get_clc_msg_smcd(pclc);
		smc_v2_ext = smc_get_clc_v2_ext(pclc);
		smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext);
		if (!pclc_smcd \|\| !smc_v2_ext \|\| !smcd_v2_ext)
		goto not_found;

		mutex_lock(&smcd_dev_list.mutex);
		if (pclc_smcd->ism.chid) {

net/smc/smc_clc.h

+7 −1

Original line number	Diff line number	Diff line
		@@ -386,9 +386,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)
		static inline struct smc_clc_smcd_v2_extension *
		smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)
		{
		u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -
		offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
		offsetof(struct smc_clc_v2_extension, hdr) -
		offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);

		if (!prop_v2ext)
		return NULL;
		if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))
		if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) \|\|
		ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)
		return NULL;

		return (struct smc_clc_smcd_v2_extension *)