[PATCH net] tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

[PATCH net] tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

[Cen Zhang (Microsoft)]

In tipc_recvmsg(), the copy length is computed as:

  copy = min_t(int, dlen - offset, buflen);

buflen is size_t but min_t(int, ...) casts it to int. When buflen
exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it
wraps negative, wins the comparison, and the negative copy length
propagates to simple_copy_to_iter() where int-to-size_t promotion
makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the
same pattern.

  Kernel panic - not syncing: kernel: panic_on_warn set ...
  RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)
  Call Trace:
   __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)
   skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)
   tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)
   io_recvmsg+0x47e/0xda0

Fix by changing min_t(int, ...) to min_t(size_t, ...) in both
functions. The result is always <= (dlen - offset), which is bounded
by TIPC maximum message size (0x1ffff bytes), so the implicit
narrowing on assignment to int copy is always safe.

Fixes: e9f8b10101c6 ("tipc: refactor function tipc_sk_recvmsg()")
Fixes: ec8a09fbbeff ("tipc: refactor function tipc_sk_recv_stream()")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
 net/tipc/socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e564341e0216..ff858727344e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1935,7 +1935,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 	if (likely(!err)) {
 		int offset = skb_cb->bytes_read;
 
-		copy = min_t(int, dlen - offset, buflen);
+		copy = min_t(size_t, dlen - offset, buflen);
 		rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy);
 		if (unlikely(rc))
 			goto exit;
@@ -2067,7 +2067,7 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
 		/* Copy data if msg ok, otherwise return error/partial data */
 		if (likely(!err)) {
 			offset = skb_cb->bytes_read;
-			copy = min_t(int, dlen - offset, buflen - copied);
+			copy = min_t(size_t, dlen - offset, buflen - copied);
 			rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy);
 			if (unlikely(rc))
 				break;
-- 
2.53.0

RE: [PATCH net] tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

[Tung Quang Nguyen]

>Subject: [PATCH net] tipc: fix integer overflow in tipc_recvmsg() and
>tipc_recvstream()
>
>In tipc_recvmsg(), the copy length is computed as:
>
>  copy = min_t(int, dlen - offset, buflen);
>
>buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX
>(e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the
>comparison, and the negative copy length propagates to simple_copy_to_iter()
>where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON.
>tipc_recvstream() has the same pattern.
>
>  Kernel panic - not syncing: kernel: panic_on_warn set ...
>  RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)
>  Call Trace:
>   __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)
>   skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)
>   tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)
>   io_recvmsg+0x47e/0xda0
>
>Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is
>always <= (dlen - offset), which is bounded by TIPC maximum message size
>(0x1ffff bytes), so the implicit narrowing on assignment to int copy is always
>safe.
>
>Fixes: e9f8b10101c6 ("tipc: refactor function tipc_sk_recvmsg()")
>Fixes: ec8a09fbbeff ("tipc: refactor function tipc_sk_recv_stream()")
>Reported-by: AutonomousCodeSecurity@microsoft.com
>Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>---

Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>