Commit 9ab332de authored by Guangguan Wang's avatar Guangguan Wang Committed by David S. Miller
Browse files

net/smc: check smcd_v2_ext_offset when receiving proposal msg 



When receiving proposal msg in server, the field smcd_v2_ext_offset in
proposal msg is from the remote client and can not be fully trusted.
Once the value of smcd_v2_ext_offset exceed the max value, there has
the chance to access wrong address, and crash may happen.

This patch checks the value of smcd_v2_ext_offset before using it.

Fixes: 5c21c4cc ("net/smc: determine accepted ISM devices")
Signed-off-by: default avatarGuangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: default avatarWen Gu <guwen@linux.alibaba.com>
Reviewed-by: default avatarD. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7863c9f3

net/smc/af_smc.c

+2 −0
Original line number Diff line number Diff line
@@ -2147,6 +2147,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc, 
	pclc_smcd = smc_get_clc_msg_smcd(pclc);

	smc_v2_ext = smc_get_clc_v2_ext(pclc);

	smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext);

	if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext)

		goto not_found;



	mutex_lock(&smcd_dev_list.mutex);

	if (pclc_smcd->ism.chid) {

net/smc/smc_clc.h

+7 −1
Original line number Diff line number Diff line
@@ -400,9 +400,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) 
static inline struct smc_clc_smcd_v2_extension *

smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)

{

	u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -

		offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -

		offsetof(struct smc_clc_v2_extension, hdr) -

		offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);



	if (!prop_v2ext)

		return NULL;

	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))

	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) ||

	    ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)

		return NULL;



	return (struct smc_clc_smcd_v2_extension *)