diff options
| author | Guangguan Wang <guangguan.wang@linux.alibaba.com> | 2024-12-11 12:21:18 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-27 15:52:53 +0300 |
| commit | 62056d1592e63d85e82357ee2ae6a6a294f440b0 (patch) | |
| tree | 2193a0f7c1f13a12890a44958c6e57d9fd4b26ac /net/smc/smc_clc.h | |
| parent | a76434c8bfcb804da55a689eb9b3eb9e08b67233 (diff) | |
| download | linux-62056d1592e63d85e82357ee2ae6a6a294f440b0.tar.xz | |
net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
[ Upstream commit a29e220d3c8edbf0e1beb0f028878a4a85966556 ]
When receiving proposal msg in server, the field iparea_offset
and the field ipv6_prefixes_cnt in proposal msg are from the
remote client and can not be fully trusted. Especially the
field iparea_offset, once exceed the max value, there has the
chance to access wrong address, and crash may happen.
This patch checks iparea_offset and ipv6_prefixes_cnt before using them.
Fixes: e7b7a64a8493 ("smc: support variable CLC proposal messages")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/smc/smc_clc.h')
| -rw-r--r-- | net/smc/smc_clc.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 5fee545c9a10..08279081d438 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -303,8 +303,12 @@ struct smc_clc_msg_decline_v2 { /* clc decline message */ static inline struct smc_clc_msg_proposal_prefix * smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc) { + u16 offset = ntohs(pclc->iparea_offset); + + if (offset > sizeof(struct smc_clc_msg_smcd)) + return NULL; return (struct smc_clc_msg_proposal_prefix *) - ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset)); + ((u8 *)pclc + sizeof(*pclc) + offset); } static inline bool smcr_indicated(int smc_type) |