linux-kernel - [PATCH] RDMA/irdma: prevent out-of-bounds shift on timeout calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20241120211809.922-1-m.masimov@maxima.ru>
Date: Thu, 21 Nov 2024 00:18:07 +0300
From: Murad Masimov <m.masimov@...ima.ru>
To: Mustafa Ismail <mustafa.ismail@...el.com>
CC: Murad Masimov <m.masimov@...ima.ru>, Tatyana Nikolova
	<tatyana.e.nikolova@...el.com>, Jason Gunthorpe <jgg@...pe.ca>, Leon
 Romanovsky <leon@...nel.org>, Shiraz Saleem <shiraz.saleem@...el.com>,
	<linux-rdma@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>
Subject: [PATCH] RDMA/irdma: prevent out-of-bounds shift on timeout calculation

After some finite number of tries, bitshift in the calculation of timetosend at
function irdma_cm_timer_tick() will lead to out-of-bounds shift, which in this
case is an undefined behaviour. For instance, if HZ is equal to 1024, the issue
occurs after 21 tries, which will take less than
IRDMA_MAX_TIMEOUT / HZ * 21 = 252 seconds.

Lower IRDMA_DEFAULT_RETRANS from 32 to 20 to prevent out-of-bounds shift for
any HZ value less than 2048.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 8385a875c9ee ("RDMA/irdma: Increase iWARP CM default rexmit count")
Signed-off-by: Murad Masimov <m.masimov@...ima.ru>
---
 drivers/infiniband/hw/irdma/cm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/cm.h b/drivers/infiniband/hw/irdma/cm.h
index 48ee285cf745..dc4ee1b185eb 100644
--- a/drivers/infiniband/hw/irdma/cm.h
+++ b/drivers/infiniband/hw/irdma/cm.h
@@ -41,7 +41,7 @@
 #define TCP_OPTIONS_PADDING	3

 #define IRDMA_DEFAULT_RETRYS	64
-#define IRDMA_DEFAULT_RETRANS	32
+#define IRDMA_DEFAULT_RETRANS	20
 #define IRDMA_DEFAULT_TTL		0x40
 #define IRDMA_DEFAULT_RTT_VAR		6
 #define IRDMA_DEFAULT_SS_THRESH		0x3fffffff
--
2.39.2