Sharath Srinivasan 344350bfa3 net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv ... [ Upstream commit 13e788deb7 ] Syzcaller UBSAN crash occurs in rds_cmsg_recv(), which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1), but with array size of 4 (RDS_RX_MAX_TRACES). Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from trace.rx_trace_pos[i] in rds_recv_track_latency(), with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the off-by-one bounds check in rds_recv_track_latency() to prevent a potential crash in rds_cmsg_recv(). Found by syzcaller: ================================================================= UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39 index 4 is out of range for type 'u64 [4]' CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348 rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585 rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1066 __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246 __do_sys_recvfrom net/socket.c:2264 [inline] __se_sys_recvfrom net/socket.c:2260 [inline] __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b ================================================================== Fixes: 3289025aed ("RDS: add receive message trace used by application") Reported-by: Chenyuan Yang <chenyuan0y@gmail.com> Closes: https://lore.kernel.org/linux-rdma/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw@mail.gmail.com/ Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-02-23 08:12:41 +01:00
..
af_rds.c	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv	2024-02-23 08:12:41 +01:00
bind.c	net/rds: Check laddr_check before calling it	2019-10-01 08:26:13 +02:00
cong.c
connection.c	rds: memory leak in __rds_conn_create()	2021-12-22 09:19:01 +01:00
ib.c	net/rds: Fix error handling in rds_ib_add_one()	2019-10-07 18:57:24 +02:00
ib.h
ib_cm.c
ib_fmr.c
ib_frmr.c	net/rds: dma_map_sg is entitled to merge entries	2021-09-03 09:58:02 +02:00
ib_mr.h
ib_rdma.c
ib_recv.c	rds: add missing barrier to release_refill	2022-08-25 11:15:34 +02:00
ib_ring.c
ib_send.c
ib_stats.c	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2020-01-27 14:51:13 +01:00
ib_sysctl.c
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-11 16:31:37 +01:00
page.c
rdma.c	net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS	2021-02-23 15:00:58 +01:00
rdma_transport.c
rdma_transport.h
rds.h
rds_single_path.h
recv.c	net: rds: fix memory leak in rds_recvmsg	2021-06-30 08:48:15 -04:00
send.c
stats.c	net/rds: Add a few missing rds_stat_names entries	2020-01-27 14:51:04 +01:00
sysctl.c
tcp.c	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()	2022-10-26 13:19:26 +02:00
tcp.h	RDS tcp loopback connection can hang	2021-06-16 11:54:57 +02:00
tcp_connect.c	net: prevent address rewrite in kernel_bind()	2023-10-25 11:16:21 +02:00
tcp_listen.c	net: prevent address rewrite in kernel_bind()	2023-10-25 11:16:21 +02:00
tcp_recv.c
tcp_send.c
tcp_stats.c
threads.c
transport.c