Messages in this thread |  | | From | Chenyuan Yang <> | | Date | Fri, 19 Jan 2024 08:29:01 -0600 | | Subject | [Linux Kernel Bug] UBSAN: array-index-out-of-bounds in rds_cmsg_recv |
| |
Dear Linux Kernel Developers for Network RDS,
We encountered "UBSAN: array-index-out-of-bounds in rds_cmsg_recv" when testing the RDS with our generated specifications. The C reproduce program and logs for this crash are attached.
This crash happens when RDS receives messages by using `rds_cmsg_recv`, which reads the `j+1` index of the array `inc->i_rx_lat_trace` (https://elixir.bootlin.com/linux/v6.7/source/net/rds/recv.c#L585). The length of `inc->i_rx_lat_trace` array is 4 (defined by `RDS_RX_MAX_TRACES`, https://elixir.bootlin.com/linux/v6.7/source/net/rds/rds.h#L289) while `j` is the value stored in another array `rs->rs_rx_trace` (https://elixir.bootlin.com/linux/v6.7/source/net/rds/recv.c#L583), which is sent from others and could be arbitrary value.
This crash might be exploited to read the value out-of-bound from the array by setting arbitrary values for the array `rs->rs_rx_trace`.
If you have any questions or require more information, please feel free to contact us.
Best, Chenyuan [unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream] |  |