net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

Browse source

[ Upstream commit 7863c9f3d2 ]

When receiving proposal msg in server, the fields v2_ext_offset/
eid_cnt/ism_gid_cnt in proposal msg are from the remote client
and can not be fully trusted. Especially the field v2_ext_offset,
once exceed the max value, there has the chance to access wrong
address, and crash may happen.

This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
before using them.

Fixes: 8c3dca341a ("net/smc: build and send V2 CLC proposal")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Guangguan Wang 2024-12-11 17:21:19 +08:00 • committed by Greg Kroah-Hartman

parent 91a7c27c14

commit 295a92e3df

3 changed files with 16 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

net/smc/af_smc.c

View file

8

net/smc/smc_clc.c

View file

8

net/smc/smc_clc.h

View file