[PATCH 6.1.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

[PATCH 6.1.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

[Junjie Cao]

From: Guangguan Wang <guangguan.wang@linux.alibaba.com>

commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf upstream.

When receiving proposal msg in server, the fields v2_ext_offset/
eid_cnt/ism_gid_cnt in proposal msg are from the remote client
and can not be fully trusted. Especially the field v2_ext_offset,
once exceed the max value, there has the chance to access wrong
address, and crash may happen.

This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
before using them.

Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ jcao: SMCD_CLC_MAX_V2_GID_ENTRIES does not exist in 6.1;
  SMC_MAX_ISM_DEVS is the same limit (8) under its pre-b40584d14570 name ]
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
Backport of the CVE-2024-49568 fix to 6.1.y. The CNA record lists
6.6.68, 6.12.7 and 6.13 as fixed and nothing for 6.1; the affected
code (v2 CLC proposal parsing) dates from 5.10. The other five fixes
from the same series are in 6.1.y since v6.1.122; this is the only
one missing.

The upstream commit cherry-picks cleanly onto v6.1.188 but does not
build there because SMCD_CLC_MAX_V2_GID_ENTRIES does not exist yet;
6.1 names the same limit SMC_MAX_ISM_DEVS (6.6.y has the new name
only because b40584d14570, a 12-file virtual-ISM change, went in as
v6.6.66). net/smc builds on x86_64 with CONFIG_SMC=m, W=1 clean.

5.15.y and 5.10.y are in the affected range as well; the commit
conflicts in af_smc.c there and needs a separate backport.

 net/smc/af_smc.c  | 3 ++-
 net/smc/smc_clc.c | 8 +++++++-
 net/smc/smc_clc.h | 8 +++++++-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 6713296fffd99..89fa7295275ca 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2225,7 +2225,8 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc,
 		goto not_found;
 
 	smc_v2_ext = smc_get_clc_v2_ext(pclc);
-	if (!smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))
+	if (!smc_v2_ext ||
+	    !smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))
 		goto not_found;
 
 	/* prepare RDMA check */
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index ad1120a43dbd9..762e50354e11f 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -352,7 +352,6 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc)
 	struct smc_clc_msg_hdr *hdr = &pclc->hdr;
 	struct smc_clc_v2_extension *v2_ext;
 
-	v2_ext = smc_get_clc_v2_ext(pclc);
 	pclc_prfx = smc_clc_proposal_get_prefix(pclc);
 	if (!pclc_prfx ||
 	    pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)
@@ -369,6 +368,13 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc)
 			sizeof(struct smc_clc_msg_trail))
 			return false;
 	} else {
+		v2_ext = smc_get_clc_v2_ext(pclc);
+		if ((hdr->typev2 != SMC_TYPE_N &&
+		     (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) ||
+		    (smcd_indicated(hdr->typev2) &&
+		     v2_ext->hdr.ism_gid_cnt > SMC_MAX_ISM_DEVS))
+			return false;
+
 		if (ntohs(hdr->length) !=
 			sizeof(*pclc) +
 			sizeof(struct smc_clc_msg_smcd) +
diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
index 0f6102cd5de17..cdba392b6ec9c 100644
--- a/net/smc/smc_clc.h
+++ b/net/smc/smc_clc.h
@@ -347,8 +347,14 @@ static inline struct smc_clc_v2_extension *
 smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)
 {
 	struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop);
+	u16 max_offset;
 
-	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset))
+	max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
+		     offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) -
+		     offsetofend(struct smc_clc_msg_smcd, v2_ext_offset);
+
+	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) ||
+	    ntohs(prop_smcd->v2_ext_offset) > max_offset)
 		return NULL;
 
 	return (struct smc_clc_v2_extension *)
-- 
2.43.0

Re: [PATCH 6.1.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

[sashiko-bot]

> From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
> 
> commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf upstream.
> 
> When receiving proposal msg in server, the fields v2_ext_offset/
> eid_cnt/ism_gid_cnt in proposal msg are from the remote client
> and can not be fully trusted. Especially the field v2_ext_offset,
> once exceed the max value, there has the chance to access wrong
> address, and crash may happen.
> 
> This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
> before using them.
> 
> Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
> Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
> Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
> Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [ jcao: SMCD_CLC_MAX_V2_GID_ENTRIES does not exist in 6.1;
>   SMC_MAX_ISM_DEVS is the same limit (8) under its pre-b40584d14570 name ]
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918045353.686837-1-junjie.cao@intel.com?part=1

Re: [PATCH 6.1.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

[Sasha Levin]

> Backport of the CVE-2024-49568 fix to 6.1.y. The CNA record lists
> 6.6.68, 6.12.7 and 6.13 as fixed and nothing for 6.1; the affected
> code (v2 CLC proposal parsing) dates from 5.10. The other five fixes
> from the same series are in 6.1.y since v6.1.122; this is the only
> one missing.

Queued for 6.1, thanks.

> 5.15.y and 5.10.y are in the affected range as well; the commit
> conflicts in af_smc.c there and needs a separate backport.

Send those along when you have them and I will queue them too.

-- 
Thanks,
Sasha