net/smc: check smcd_v2_ext_offset when receiving proposal msg

[ Upstream commit 9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad ]

When receiving proposal msg in server, the field smcd_v2_ext_offset in
proposal msg is from the remote client and can not be fully trusted.
Once the value of smcd_v2_ext_offset exceed the max value, there has
the chance to access wrong address, and crash may happen.

This patch checks the value of smcd_v2_ext_offset before using it.

Fixes: 5c21c4ccafe8 ("net/smc: determine accepted ISM devices")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 889709c35b1f6fc93af0132521000a8497a9672f..e2bdd6aa3d89ca3dc3ff150ccdd62d52154f6ffc 100644 (file)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2096,6 +2096,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc,
        pclc_smcd = smc_get_clc_msg_smcd(pclc);
        smc_v2_ext = smc_get_clc_v2_ext(pclc);
        smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext);
+       if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext)
+               goto not_found;
 
        mutex_lock(&smcd_dev_list.mutex);
        if (pclc_smcd->ism.chid)

diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
index 08279081d438c126ff2f38b60019ca2b09d38b26..0f6102cd5de1704ef465a72fe6174f468288a2ce 100644 (file)
--- a/net/smc/smc_clc.h
+++ b/net/smc/smc_clc.h
@@ -361,9 +361,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)
 static inline struct smc_clc_smcd_v2_extension *
 smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)
 {
+       u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -
+               offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
+               offsetof(struct smc_clc_v2_extension, hdr) -
+               offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);
+
        if (!prop_v2ext)
                return NULL;
-       if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))
+       if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) ||
+           ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)
                return NULL;
 
        return (struct smc_clc_smcd_v2_extension *)