[PATCH] net/smc: bound sndbuf_space on the SMC-D DMB-merge receive path

[Bryam Vargas]

When the SMC-D send buffer is merged with the peer's DMB (the nocopy
DMB-merge path), smc_cdc_msg_recv_action() advances the local send-buffer
free space from the peer's consumer cursor:

	diff_tx = smc_curs_diff(conn->sndbuf_desc->len,
				&conn->tx_curs_fin,
				&conn->local_rx_ctrl.cons);
	atomic_add(diff_tx, &conn->sndbuf_space);

conn->local_rx_ctrl.cons is the peer's consumer cursor, copied verbatim
from the wire by smcd_cdc_msg_to_host() with no validation.
smc_curs_diff()'s differing-wrap branch returns
(size - old.count) + new.count, which exceeds size for a forged cursor,
so a malicious peer can drive sndbuf_space past sndbuf_desc->len. The
"guarantee 0 <= sndbuf_space <= sndbuf_desc->len" comment on the
atomic_add() is not enforced.

smc_tx_sendmsg() then reads the inflated sndbuf_space as the available
write space and copies that many user bytes into the send buffer; its
two-chunk wrap-around copy bounds only the first chunk to
sndbuf_desc->len, so the second chunk (copylen - first_chunk, written at
offset 0) runs past the send buffer -- a heap out-of-bounds write of
attacker-influenced length with user-controlled content.

Enforce the documented invariant after the cursor-driven atomic_add(), as
the SMC-D receive path already does for bytes_to_rcv.

Fixes: cc0ab806fc52 ("net/smc: adapt cursor update when sndbuf and peer DMB are merged")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
---
The out-of-bounds write was reproduced under KASAN by driving
smc_tx_sendmsg()'s two-chunk send-ring copy with an inflated sndbuf_space
(slab-out-of-bounds Write); with the clamp the same input keeps the copy
within sndbuf_desc->len. The DMB-merge/nocopy path that lets a peer
consumer cursor inflate sndbuf_space is reachable with the in-kernel
loopback-ism (CONFIG_SMC_LO), which advertises dmb_nocopy, on commodity
x86 -- no special hardware is required to exercise it.

 net/smc/smc_cdc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 619b3bab3824..cf8d65407ea5 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -365,6 +365,10 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
 			smp_mb__before_atomic();
 			atomic_add(diff_tx, &conn->sndbuf_space);
 			/* guarantee 0 <= sndbuf_space <= sndbuf_desc->len */
+			if (atomic_read(&conn->sndbuf_space) >
+			    conn->sndbuf_desc->len)
+				atomic_set(&conn->sndbuf_space,
+					   conn->sndbuf_desc->len);
 			smp_mb__after_atomic();
 			smc_curs_copy(&conn->tx_curs_fin,
 				      &conn->local_rx_ctrl.cons, conn);
-- 
2.43.0