[PATCH v2] infiniband/uverbs: Fix integer overflows

[PATCH v2] infiniband/uverbs: Fix integer overflows

[Vlad Tsyrklevich]

The 'num_sge' variable is verfied to be smaller than the 'sge_count'
variable; however, since both are user-controlled it's possible to cause
an integer overflow for the kmalloc multiply on 32-bit platforms
(num_sge and sge_count are both defined u32). By crafting an input that
causes a smaller-than-expected allocation it's possible to write
controlled data out-of-bounds.

Signed-off-by: Vlad Tsyrklevich <vlad-NIZqynvkaCU43zv7NVfAiQ@public.gmane.org>
---
 drivers/infiniband/core/uverbs_cmd.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 7007822..5469088 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2542,9 +2542,13 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
 
 static void *alloc_wr(size_t wr_size, __u32 num_sge)
 {
+	if (num_sge >= (U32_MAX - ALIGN(wr_size, sizeof (struct ib_sge))) /
+		       sizeof (struct ib_sge))
+		return NULL;
+
 	return kmalloc(ALIGN(wr_size, sizeof (struct ib_sge)) +
 			 num_sge * sizeof (struct ib_sge), GFP_KERNEL);
-};
+}
 
 ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
 			    struct ib_device *ib_dev,
@@ -2771,6 +2775,13 @@ static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf,
 			goto err;
 		}
 
+		if (user_wr->num_sge >=
+		    (U32_MAX - ALIGN(sizeof *next, sizeof (struct ib_sge))) /
+		    sizeof (struct ib_sge)) {
+			ret = -EINVAL;
+			goto err;
+		}
+
 		next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) +
 			       user_wr->num_sge * sizeof (struct ib_sge),
 			       GFP_KERNEL);
-- 
2.7.0

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH v2] infiniband/uverbs: Fix integer overflows

[Bart Van Assche]

On Fri, 2017-03-24 at 15:55 -0400, Vlad Tsyrklevich wrote:
> The 'num_sge' variable is verfied to be smaller than the 'sge_count'
> variable; however, since both are user-controlled it's possible to cause
> an integer overflow for the kmalloc multiply on 32-bit platforms
> (num_sge and sge_count are both defined u32). By crafting an input that
> causes a smaller-than-expected allocation it's possible to write
> controlled data out-of-bounds.

Hello Vlad,

Do you think that an RDMA driver exists that supports a max_sge value that
is large enough to cause this multiplication to overflow?

Bart.--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH v2] infiniband/uverbs: Fix integer overflows

[Vlad Tsyrklevich]

[replying again to the list with HTML e-mails turned off]

I doubt it. I chose to implement a naive integer overflow check here
instead of checking against some device-specific value since I'm
unfamiliar with the infiniband internals and don't have appropriate
hardware to test such a change against.

On Fri, Mar 24, 2017 at 4:02 PM, Bart Van Assche
<Bart.VanAssche-XdAiOPVOjttBDgjK7y7TUQ@public.gmane.org> wrote:
> On Fri, 2017-03-24 at 15:55 -0400, Vlad Tsyrklevich wrote:
>> The 'num_sge' variable is verfied to be smaller than the 'sge_count'
>> variable; however, since both are user-controlled it's possible to cause
>> an integer overflow for the kmalloc multiply on 32-bit platforms
>> (num_sge and sge_count are both defined u32). By crafting an input that
>> causes a smaller-than-expected allocation it's possible to write
>> controlled data out-of-bounds.
>
> Hello Vlad,
>
> Do you think that an RDMA driver exists that supports a max_sge value that
> is large enough to cause this multiplication to overflow?
>
> Bart.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH v2] infiniband/uverbs: Fix integer overflows

[Doug Ledford]

On Fri, 2017-03-24 at 16:45 -0400, Vlad Tsyrklevich wrote:
> [replying again to the list with HTML e-mails turned off]
> 
> I doubt it. I chose to implement a naive integer overflow check here
> instead of checking against some device-specific value since I'm
> unfamiliar with the infiniband internals and don't have appropriate
> hardware to test such a change against.

Thanks, applied.

-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
    GPG KeyID: B826A3330E572FDD
   
Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html