Sharath Srinivasan 13e788deb7 net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv ... Syzcaller UBSAN crash occurs in rds_cmsg_recv(), which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1), but with array size of 4 (RDS_RX_MAX_TRACES). Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from trace.rx_trace_pos[i] in rds_recv_track_latency(), with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the off-by-one bounds check in rds_recv_track_latency() to prevent a potential crash in rds_cmsg_recv(). Found by syzcaller: ================================================================= UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39 index 4 is out of range for type 'u64 [4]' CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348 rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585 rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1066 __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246 __do_sys_recvfrom net/socket.c:2264 [inline] __se_sys_recvfrom net/socket.c:2260 [inline] __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b ================================================================== Fixes: 3289025aed ("RDS: add receive message trace used by application") Reported-by: Chenyuan Yang <chenyuan0y@gmail.com> Closes: https://lore.kernel.org/linux-rdma/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw@mail.gmail.com/ Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2024-01-22 11:24:00 +00:00
..
af_rds.c	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv	2024-01-22 11:24:00 +00:00
bind.c	treewide: use get_random_{u8,u16}() when possible, part 2	2022-10-11 17:42:58 -06:00
cong.c	net: rds: delete duplicated words	2020-09-18 14:12:43 -07:00
connection.c	rds: memory leak in __rds_conn_create()	2021-12-14 12:51:52 +00:00
ib_cm.c	rds: ib: Remove two ib_modify_qp() calls	2021-04-12 19:51:48 -03:00
ib_frmr.c	net/rds: dma_map_sg is entitled to merge entries	2021-08-18 15:35:50 -07:00
ib_mr.h	RDMA/rds: Remove FMR support for memory registration	2020-06-02 20:32:53 -03:00
ib_rdma.c	RDMA/rds: Remove FMR support for memory registration	2020-06-02 20:32:53 -03:00
ib_recv.c	net: add missing includes of linux/sched/clock.h	2023-01-27 11:19:46 +00:00
ib_ring.c	rds: Fix spelling mistakes	2021-05-31 22:45:05 -07:00
ib_send.c	rds: Remove redundant assignment to nr_sig	2021-04-27 14:14:33 -07:00
ib_stats.c	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2019-09-15 20:56:19 +02:00
ib_sysctl.c
ib.c	RDMA: Split kernel-only global device caps from uverbs device caps	2022-04-06 15:02:13 -03:00
ib.h	rds: stop using dmapool	2020-11-17 15:22:06 -04:00
info.c	rds: fix crash in rds_info_getsockopt()	2020-05-20 14:08:06 -07:00
info.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
loop.c	rds: Changing IP address internal representation to struct in6_addr	2018-07-23 21:17:44 -07:00
loop.h	rds: clean up loopback rds_connections on netns deletion	2018-06-27 10:11:03 +09:00
Makefile	RDMA/rds: Remove FMR support for memory registration	2020-06-02 20:32:53 -03:00
message.c	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-02-13 09:33:39 +00:00
page.c
rdma_transport.c	net: rds: Fix possible NULL-pointer dereference	2023-09-20 08:49:03 +01:00
rdma_transport.h	net/rds: Remove unused function declarations	2023-08-13 12:25:42 +01:00
rdma.c	net/rds: Use PTR_ERR instead of IS_ERR for rdsdebug()	2022-08-01 11:45:15 +01:00
rds_single_path.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
rds.h	net/rds: Remove unused function declarations	2023-08-13 12:25:42 +01:00
recv.c	net: add missing includes of linux/sched/clock.h	2023-01-27 11:19:46 +00:00
send.c	rds: remove redundant variable total_payload_len	2022-11-04 10:09:50 +00:00
stats.c	rds: check for excessive looping in rds_send_xmit	2019-08-15 12:04:24 -07:00
sysctl.c
tcp_connect.c	net: prevent address rewrite in kernel_bind()	2023-10-01 19:31:29 +01:00
tcp_listen.c	ipv6: annotate data-races around np->mcast_oif	2023-12-11 10:59:17 +00:00
tcp_recv.c	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
tcp_send.c	rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage	2023-06-24 15:50:12 -07:00
tcp_stats.c
tcp.c	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
tcp.h	net/rds: Remove unused function declarations	2023-08-13 12:25:42 +01:00
threads.c	rds: Fix fall-through warnings for Clang	2021-05-17 20:00:27 -05:00
transport.c	rds: transport module should be auto loaded when transport is set	2020-06-25 16:26:25 -07:00