Repository navigation
Conversation
ibv_cmd_create_rwq_ind_table() derives the size of a stack allocation from
the caller's log_ind_tbl_size without checking it against the limit the
kernel interface defines:
num_tbl_entries = 1 << init_attr->log_ind_tbl_size;
cmd_size = sizeof(*cmd) + num_tbl_entries * sizeof(cmd->wq_handles[0]);
cmd_size = (cmd_size + 7) / 8 * 8;
cmd = alloca(cmd_size);
IB_USER_VERBS_MAX_LOG_IND_TBL_SIZE is the largest value the kernel accepts,
but it is never consulted. A larger value makes the alloca() consume the
thread stack, and the loop that fills the message reads past the caller's
ind_tbl array:
for (i = 0; i < num_tbl_entries; i++)
cmd->wq_handles[i] = init_attr->ind_tbl[i]->handle;
Reject a size the kernel would not accept before computing anything.
Fixes: 0672e79 ("Introduce Receive Work Queue indirection table and its verbs")
Signed-off-by: Li Bingzhuo <lbz2770828522@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The indirection table creation helper sizes a stack allocation from the
caller's
log_ind_tbl_sizeand then indexes the caller's array with the samecount. Neither is checked against
IB_USER_VERBS_MAX_LOG_IND_TBL_SIZE, thelargest value the kernel interface accepts, so a larger value either exhausts
the thread stack or reads past the caller's array.
The change rejects a size the kernel would not accept before any of the size
arithmetic is performed, so a rejected request never touches
ind_tbl. It isconfined to
libibverbs/cmd.c.Reproduction: call
ibv_create_rwq_ind_table()through a provider entry pointwith
log_ind_tbl_sizeset to 14 or above, built with AddressSanitizer andUBSan. Before the change this reports a dynamic-stack-buffer overflow at the
alloca()and, for larger values, a shift that exceeds the width of theoperand. Values up to the documented maximum behave as before.