releases/3.18.137/ipvs-fix-signed-integer-overflow-when-setsockopt-tim.patch

   1 From 72b214f9b23b1e9819df887e01b9126496e0cca9 Mon Sep 17 00:00:00 2001
   2 From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
   3 Date: Thu, 10 Jan 2019 16:39:06 +0800
   4 Subject: ipvs: Fix signed integer overflow when setsockopt timeout
   5
   6 [ Upstream commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 ]
   7
   8 There is a UBSAN bug report as below:
   9 UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21
  10 signed integer overflow:
  11 -2147483647 * 1000 cannot be represented in type 'int'
  12
  13 Reproduce program:
  14         #include <stdio.h>
  15         #include <sys/types.h>
  16         #include <sys/socket.h>
  17
  18         #define IPPROTO_IP 0
  19         #define IPPROTO_RAW 255
  20
  21         #define IP_VS_BASE_CTL          (64+1024+64)
  22         #define IP_VS_SO_SET_TIMEOUT    (IP_VS_BASE_CTL+10)
  23
  24         /* The argument to IP_VS_SO_GET_TIMEOUT */
  25         struct ipvs_timeout_t {
  26                 int tcp_timeout;
  27                 int tcp_fin_timeout;
  28                 int udp_timeout;
  29         };
  30
  31         int main() {
  32                 int ret = -1;
  33                 int sockfd = -1;
  34                 struct ipvs_timeout_t to;
  35
  36                 sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  37                 if (sockfd == -1) {
  38                         printf("socket init error\n");
  39                         return -1;
  40                 }
  41
  42                 to.tcp_timeout = -2147483647;
  43                 to.tcp_fin_timeout = -2147483647;
  44                 to.udp_timeout = -2147483647;
  45
  46                 ret = setsockopt(sockfd,
  47                                  IPPROTO_IP,
  48                                  IP_VS_SO_SET_TIMEOUT,
  49                                  (char *)(&to),
  50                                  sizeof(to));
  51
  52                 printf("setsockopt return %d\n", ret);
  53                 return ret;
  54         }
  55
  56 Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
  57
  58 Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
  59 Acked-by: Simon Horman <horms@verge.net.au>
  60 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  61 Signed-off-by: Sasha Levin <sashal@kernel.org>
  62 ---
  63  net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++
  64  1 file changed, 12 insertions(+)
  65
  66 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
  67 index 9b1452e8e868..444a0cb33e97 100644
  68 --- a/net/netfilter/ipvs/ip_vs_ctl.c
  69 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
  70 @@ -2182,6 +2182,18 @@ static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
  71                   u->tcp_fin_timeout,
  72                   u->udp_timeout);
  73
  74 +#ifdef CONFIG_IP_VS_PROTO_TCP
  75 +       if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
  76 +           u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
  77 +               return -EINVAL;
  78 +       }
  79 +#endif
  80 +
  81 +#ifdef CONFIG_IP_VS_PROTO_UDP
  82 +       if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
  83 +               return -EINVAL;
  84 +#endif
  85 +
  86  #ifdef CONFIG_IP_VS_PROTO_TCP
  87         if (u->tcp_timeout) {
  88                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
  89 --
  90 2.19.1
  91