Patch "net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-rds-fix-ubsan-array-index-out-of-bounds-in-rds_c.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1ce7852534968cf7a8bdb2b39197c286ea1f2706
Author: Sharath Srinivasan <sharath.srinivasan@xxxxxxxxxx>
Date:   Fri Jan 19 17:48:39 2024 -0800

    net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
    
    [ Upstream commit 13e788deb7348cc88df34bed736c3b3b9927ea52 ]
    
    Syzcaller UBSAN crash occurs in rds_cmsg_recv(),
    which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1),
    but with array size of 4 (RDS_RX_MAX_TRACES).
    Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from
    trace.rx_trace_pos[i] in rds_recv_track_latency(),
    with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the
    off-by-one bounds check in rds_recv_track_latency() to prevent
    a potential crash in rds_cmsg_recv().
    
    Found by syzcaller:
    =================================================================
    UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39
    index 4 is out of range for type 'u64 [4]'
    CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
    BIOS 1.15.0-1 04/01/2014
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
     ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348
     rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585
     rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716
     sock_recvmsg_nosec net/socket.c:1044 [inline]
     sock_recvmsg+0xe2/0x160 net/socket.c:1066
     __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246
     __do_sys_recvfrom net/socket.c:2264 [inline]
     __se_sys_recvfrom net/socket.c:2260 [inline]
     __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260
     do_syscall_x64 arch/x86/entry/common.c:51 [inline]
     do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
     entry_SYSCALL_64_after_hwframe+0x63/0x6b
    ==================================================================
    
    Fixes: 3289025aedc0 ("RDS: add receive message trace used by application")
    Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>
    Closes: https://lore.kernel.org/linux-rdma/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw@xxxxxxxxxxxxxx/
    Signed-off-by: Sharath Srinivasan <sharath.srinivasan@xxxxxxxxxx>
    Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index cd7e01ea8144..5eb71d276706 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -385,7 +385,7 @@ static int rds_recv_track_latency(struct rds_sock *rs, char __user *optval,
 
 	rs->rs_rx_traces = trace.rx_traces;
 	for (i = 0; i < rs->rs_rx_traces; i++) {
-		if (trace.rx_trace_pos[i] > RDS_MSG_RX_DGRAM_TRACE_MAX) {
+		if (trace.rx_trace_pos[i] >= RDS_MSG_RX_DGRAM_TRACE_MAX) {
 			rs->rs_rx_traces = 0;
 			return -EFAULT;
 		}