From: Chuck Lever <chuck.lever@oracle.com> stable inclusion from stable-v6.6.64 commit 838dd342962cef4c320632a5af48d3c31f2f9877 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGF CVE: CVE-2024-53151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... ------------------------------------------------- [ Upstream commit 3c63d8946e578663b868cb9912dac616ea68bfd0 ] Dan Carpenter reports:
Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure") from Jun 22, 2020 (linux-next), leads to the following Smatch static checker warning:
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) 489 { 490 u32 segcount; 491 __be32 *p; 492 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) ^^^^^^^^
494 return false; 495 496 /* A bogus segcount causes this buffer overflow check to fail. */ 497 p = xdr_inline_decode(&rctxt->rc_stream, --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));
segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will have an integer overflow and some those values will be accepted by xdr_inline_decode().
Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure") Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Liu Jian <liujian56@huawei.com> --- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c index 3b05f90a3e50d..9cec7bcb8a976 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c @@ -478,7 +478,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) return false; - /* A bogus segcount causes this buffer overflow check to fail. */ + /* Before trusting the segcount value enough to use it in + * a computation, perform a simple range check. This is an + * arbitrary but sensible limit (ie, not architectural). + */ + if (unlikely(segcount > RPCSVC_MAXPAGES)) + return false; + p = xdr_inline_decode(&rctxt->rc_stream, segcount * rpcrdma_segment_maxsz * sizeof(*p)); return p != NULL; -- 2.34.1