Chuck Lever
3c63d8946e
svcrdma: Address an integer overflow
Dan Carpenter reports:
> Commit 78147ca8b4 ("svcrdma: Add a "parsed chunk list" data
> structure") from Jun 22, 2020 (linux-next), leads to the following
> Smatch static checker warning:
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
> warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
> 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
> 489 {
> 490 u32 segcount;
> 491 __be32 *p;
> 492
> 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
> ^^^^^^^^
>
> 494 return false;
> 495
> 496 /* A bogus segcount causes this buffer overflow check to fail. */
> 497 p = xdr_inline_decode(&rctxt->rc_stream,
> --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));
>
>
> segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will
> have an integer overflow and some those values will be accepted by
> xdr_inline_decode().
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: 78147ca8b4 ("svcrdma: Add a "parsed chunk list" data structure")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2024-11-11 13:41:57 -05:00
..
2024-08-12 17:23:57 -07:00
2024-10-21 15:41:29 -07:00
2024-10-02 17:23:23 -04:00
2024-09-03 11:36:43 +02:00
2024-05-09 10:01:01 -07:00
2024-06-14 19:08:50 -07:00
2024-06-01 15:49:42 -07:00
2024-10-02 17:23:23 -04:00
2024-10-30 14:49:09 -04:00
2024-10-31 16:15:21 +01:00
2024-10-10 15:39:35 +02:00
2024-10-02 17:23:23 -04:00
2024-09-15 09:13:19 -07:00
2024-08-27 09:30:16 +02:00
2024-10-31 14:56:19 -10:00
2024-10-02 17:23:23 -04:00
2024-06-05 10:24:57 +01:00
2024-10-09 19:41:35 -07:00
2024-05-25 10:48:57 -07:00
2024-09-13 21:40:12 -07:00
2024-08-27 16:09:25 -07:00
2024-09-12 17:11:24 -07:00
2024-09-03 11:36:43 +02:00
2024-10-31 14:56:19 -10:00
2024-10-30 13:17:36 +01:00
2024-08-22 13:09:20 -07:00
2024-08-19 18:36:12 -07:00
2024-10-15 17:52:58 -07:00
2024-07-15 08:51:19 -07:00
2024-10-26 00:42:49 +02:00
2024-10-03 09:44:00 -07:00
2024-10-10 15:39:35 +02:00
2024-10-10 15:39:35 +02:00
2024-11-05 17:51:09 -08:00
2024-10-03 10:14:14 +02:00
2024-11-07 12:28:47 +01:00
2024-05-13 14:58:12 -07:00
2024-10-15 17:52:58 -07:00
2024-08-29 12:33:07 -07:00
2024-05-23 12:49:37 -07:00
2024-09-03 11:36:43 +02:00
2024-09-11 20:44:31 -07:00
2024-10-10 15:39:36 +02:00
2024-07-11 18:11:31 -07:00
2024-09-24 10:48:16 +02:00
2024-08-09 13:18:46 +01:00
2024-09-27 08:18:43 -07:00
2024-05-13 18:19:09 -06:00
2024-11-07 11:30:34 -08:00
2024-10-29 11:45:23 -07:00
2024-11-03 11:03:23 -08:00
2024-11-07 11:31:14 -08:00
2024-11-11 13:41:57 -05:00
2024-05-08 12:19:12 +01:00
2024-09-15 09:13:19 -07:00
2024-10-02 17:23:23 -04:00
2024-09-09 17:14:27 -07:00
2024-10-18 16:27:14 -07:00
2024-10-25 17:53:40 +02:00
2024-05-13 18:19:09 -06:00
2024-09-21 09:27:50 -07:00
2024-10-24 11:11:33 +02:00
2024-09-13 11:41:45 -07:00
2024-10-07 16:21:59 -07:00
2024-06-13 10:50:52 +02:00