[PATCH 5.15.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
From: Junjie Cao <hidden>
Date: 2026-09-20 05:13:51
Also in:
linux-rdma, linux-s390, stable
Subsystem:
networking [general], shared memory communications (smc) sockets, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, D. Wythe, Dust Li, Sidraya Jayagond, Mahanta Jambigi, Linus Torvalds
From: Guangguan Wang <redacted>
commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf upstream.
When receiving proposal msg in server, the fields v2_ext_offset/
eid_cnt/ism_gid_cnt in proposal msg are from the remote client
and can not be fully trusted. Especially the field v2_ext_offset,
once exceed the max value, there has the chance to access wrong
address, and crash may happen.
This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
before using them.
Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
Signed-off-by: Guangguan Wang <redacted>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ jcao: drop the af_smc.c hunk, smc_find_rdma_v2_device_serv() came
with SMC-Rv2 in e49300a6bf62 (v5.16); take SMC_CLC_MAX_UEID from
fa0866625543 (v5.16); SMC_MAX_ISM_DEVS is the pre-b40584d14570 name
of SMCD_CLC_MAX_V2_GID_ENTRIES ]
Signed-off-by: Junjie Cao <redacted>
---
5.15.y backport of the CVE-2024-49568 fix, requested in the 6.1.y
thread:
https://lore.kernel.org/r/20260918045353.686837-1-junjie.cao@intel.com (local)
Differences from the 6.1.y version: no af_smc.c hunk; the callers of
smc_get_clc_v2_ext() in af_smc.c already handle NULL. The
SMC_CLC_MAX_UEID define comes along. 5.15 has no UEID support and
uses the received eid_cnt only in the length check of
smc_clc_msg_prop_valid(); 8 is the limit newer kernels apply to the
same field.
net/smc builds on v5.15.221, x86_64, CONFIG_SMC=m, W=1 clean. Not
runtime-tested.
net/smc/smc_clc.c | 8 +++++++-
net/smc/smc_clc.h | 9 ++++++++-
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index fb214faf5f984..0c2c0b2edfdff 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c@@ -47,7 +47,6 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) struct smc_clc_msg_hdr *hdr = &pclc->hdr; struct smc_clc_v2_extension *v2_ext; - v2_ext = smc_get_clc_v2_ext(pclc); pclc_prfx = smc_clc_proposal_get_prefix(pclc); if (!pclc_prfx || pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)
@@ -64,6 +63,13 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) sizeof(struct smc_clc_msg_trail)) return false; } else { + v2_ext = smc_get_clc_v2_ext(pclc); + if ((hdr->typev2 != SMC_TYPE_N && + (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) || + (smcd_indicated(hdr->typev2) && + v2_ext->hdr.ism_gid_cnt > SMC_MAX_ISM_DEVS)) + return false; + if (ntohs(hdr->length) != sizeof(*pclc) + sizeof(struct smc_clc_msg_smcd) +
diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
index 78a94b9122b64..bda7c0384b845 100644
--- a/net/smc/smc_clc.h
+++ b/net/smc/smc_clc.h@@ -158,6 +158,7 @@ struct smc_clc_msg_proposal { /* clc proposal message sent by Linux */ } __aligned(4); #define SMC_CLC_MAX_V6_PREFIX 8 +#define SMC_CLC_MAX_UEID 8 struct smc_clc_msg_proposal_area { struct smc_clc_msg_proposal pclc_base;
@@ -297,8 +298,14 @@ static inline struct smc_clc_v2_extension * smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) { struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop); + u16 max_offset; - if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset)) + max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) - + offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) - + offsetofend(struct smc_clc_msg_smcd, v2_ext_offset); + + if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) || + ntohs(prop_smcd->v2_ext_offset) > max_offset) return NULL; return (struct smc_clc_v2_extension *)
--
2.43.0