system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-07-09 04:38:56 +00:00
Code Issues Packages Projects Releases Wiki Activity
3fcb9d1720
linux/net/rds
History
Sharath Srinivasan 13e788deb7 net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 
Syzcaller UBSAN crash occurs in rds_cmsg_recv(),
which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1),
but with array size of 4 (RDS_RX_MAX_TRACES).
Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from
trace.rx_trace_pos[i] in rds_recv_track_latency(),
with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the
off-by-one bounds check in rds_recv_track_latency() to prevent
a potential crash in rds_cmsg_recv().

Found by syzcaller:
=================================================================
UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39
index 4 is out of range for type 'u64 [4]'
CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348
 rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585
 rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716
 sock_recvmsg_nosec net/socket.c:1044 [inline]
 sock_recvmsg+0xe2/0x160 net/socket.c:1066
 __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246
 __do_sys_recvfrom net/socket.c:2264 [inline]
 __se_sys_recvfrom net/socket.c:2260 [inline]
 __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
==================================================================

Fixes: 3289025aed ("RDS: add receive message trace used by application")
Reported-by: Chenyuan Yang <chenyuan0y@gmail.com>
Closes: https://lore.kernel.org/linux-rdma/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw@mail.gmail.com/
Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-01-22 11:24:00 +00:00
..
af_rds.c net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 2024-01-22 11:24:00 +00:00
bind.c treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
cong.c net: rds: delete duplicated words 2020-09-18 14:12:43 -07:00
connection.c rds: memory leak in __rds_conn_create() 2021-12-14 12:51:52 +00:00
ib_cm.c rds: ib: Remove two ib_modify_qp() calls 2021-04-12 19:51:48 -03:00
ib_frmr.c net/rds: dma_map_sg is entitled to merge entries 2021-08-18 15:35:50 -07:00
ib_mr.h RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_rdma.c RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_recv.c net: add missing includes of linux/sched/clock.h 2023-01-27 11:19:46 +00:00
ib_ring.c rds: Fix spelling mistakes 2021-05-31 22:45:05 -07:00
ib_send.c rds: Remove redundant assignment to nr_sig 2021-04-27 14:14:33 -07:00
ib_stats.c net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' 2019-09-15 20:56:19 +02:00
ib_sysctl.c
ib.c RDMA: Split kernel-only global device caps from uverbs device caps 2022-04-06 15:02:13 -03:00
ib.h rds: stop using dmapool 2020-11-17 15:22:06 -04:00
info.c rds: fix crash in rds_info_getsockopt() 2020-05-20 14:08:06 -07:00
info.h
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
loop.c
loop.h
Makefile RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
message.c rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-02-13 09:33:39 +00:00
page.c
rdma_transport.c net: rds: Fix possible NULL-pointer dereference 2023-09-20 08:49:03 +01:00
rdma_transport.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rdma.c net/rds: Use PTR_ERR instead of IS_ERR for rdsdebug() 2022-08-01 11:45:15 +01:00
rds_single_path.h
rds.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
recv.c net: add missing includes of linux/sched/clock.h 2023-01-27 11:19:46 +00:00
send.c rds: remove redundant variable total_payload_len 2022-11-04 10:09:50 +00:00
stats.c rds: check for excessive looping in rds_send_xmit 2019-08-15 12:04:24 -07:00
sysctl.c
tcp_connect.c net: prevent address rewrite in kernel_bind() 2023-10-01 19:31:29 +01:00
tcp_listen.c ipv6: annotate data-races around np->mcast_oif 2023-12-11 10:59:17 +00:00
tcp_recv.c net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
tcp_send.c rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage 2023-06-24 15:50:12 -07:00
tcp_stats.c
tcp.c networking: Update to register_net_sysctl_sz 2023-08-15 15:26:18 -07:00
tcp.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
threads.c rds: Fix fall-through warnings for Clang 2021-05-17 20:00:27 -05:00
transport.c rds: transport module should be auto loaded when transport is set 2020-06-25 16:26:25 -07:00