net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg

[ Upstream commit a29e220d3c8edbf0e1beb0f028878a4a85966556 ]

When receiving proposal msg in server, the field iparea_offset
and the field ipv6_prefixes_cnt in proposal msg are from the
remote client and can not be fully trusted. Especially the
field iparea_offset, once exceed the max value, there has the
chance to access wrong address, and crash may happen.

This patch checks iparea_offset and ipv6_prefixes_cnt before using them.

Fixes: e7b7a64a8493 ("smc: support variable CLC proposal messages")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 3a4ae589671ad79a0456a22f7b3159fffb1fd512..0e0a12f4bb61fc15f20282afd6e813a1a17988ff 100644 (file)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1422,6 +1422,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc,
        if (pclc->hdr.typev1 == SMC_TYPE_N)
                return 0;
        pclc_prfx = smc_clc_proposal_get_prefix(pclc);
+       if (!pclc_prfx)
+               return -EPROTO;
        if (smc_clc_prfx_match(newclcsock, pclc_prfx))
                return SMC_CLC_DECL_DIFFPREFIX;
 
@@ -1578,7 +1580,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc,
        struct smc_clc_msg_smcd *pclc_smcd = smc_get_clc_msg_smcd(pclc);
 
        /* check if ISM V1 is available */
-       if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1))
+       if (!(ini->smcd_version & SMC_V1) ||
+           !smcd_indicated(ini->smc_type_v1) ||
+           !pclc_smcd)
                goto not_found;
        ini->is_smcd = true; /* prepare ISM check */
        ini->ism_peer_gid[0] = ntohll(pclc_smcd->ism.gid);

diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 5ee5b2ce29a6e2c99d4f745b6cd435079a385489..32cbdc321aec08c5d9303d96a1d94936793b2bd2 100644 (file)
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -49,6 +49,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc)
 
        v2_ext = smc_get_clc_v2_ext(pclc);
        pclc_prfx = smc_clc_proposal_get_prefix(pclc);
+       if (!pclc_prfx ||
+           pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)
+               return false;
+
        if (hdr->version == SMC_V1) {
                if (hdr->typev1 == SMC_TYPE_N)
                        return false;

diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
index c579d1d5995a9e94c608eb4f3db521c97d471f5d..a57a3489df4ae75656c4fbdb273d57f18d45386d 100644 (file)
--- a/net/smc/smc_clc.h
+++ b/net/smc/smc_clc.h
@@ -259,8 +259,12 @@ struct smc_clc_msg_decline {       /* clc decline message */
 static inline struct smc_clc_msg_proposal_prefix *
 smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc)
 {
+       u16 offset = ntohs(pclc->iparea_offset);
+
+       if (offset > sizeof(struct smc_clc_msg_smcd))
+               return NULL;
        return (struct smc_clc_msg_proposal_prefix *)
-              ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset));
+              ((u8 *)pclc + sizeof(*pclc) + offset);
 }
 
 static inline bool smcr_indicated(int smc_type)