Patch "svcrdma: Address an integer overflow" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    svcrdma: Address an integer overflow

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     svcrdma-address-an-integer-overflow.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c395390df2cbe744d54901746ae2bf1fbe5f6b62
Author: Chuck Lever <chuck.lever@xxxxxxxxxx>
Date:   Tue Sep 17 12:15:29 2024 -0400

    svcrdma: Address an integer overflow
    
    [ Upstream commit 3c63d8946e578663b868cb9912dac616ea68bfd0 ]
    
    Dan Carpenter reports:
    > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data
    > structure") from Jun 22, 2020 (linux-next), leads to the following
    > Smatch static checker warning:
    >
    >       net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
    >       warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
    >
    > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
    >     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
    >     489 {
    >     490         u32 segcount;
    >     491         __be32 *p;
    >     492
    >     493         if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
    >                                                               ^^^^^^^^
    >
    >     494                 return false;
    >     495
    >     496         /* A bogus segcount causes this buffer overflow check to fail. */
    >     497         p = xdr_inline_decode(&rctxt->rc_stream,
    > --> 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));
    >
    >
    > segcount is an untrusted u32.  On 32bit systems anything >= SIZE_MAX / 16 will
    > have an integer overflow and some those values will be accepted by
    > xdr_inline_decode().
    
    Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure")
    Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 9a80d3be1f635..adfe05f19060a 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -477,7 +477,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
 	if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
 		return false;
 
-	/* A bogus segcount causes this buffer overflow check to fail. */
+	/* Before trusting the segcount value enough to use it in
+	 * a computation, perform a simple range check. This is an
+	 * arbitrary but sensible limit (ie, not architectural).
+	 */
+	if (unlikely(segcount > RPCSVC_MAXPAGES))
+		return false;
+
 	p = xdr_inline_decode(&rctxt->rc_stream,
 			      segcount * rpcrdma_segment_maxsz * sizeof(*p));
 	return p != NULL;