CVE-2024-53151: svcrdma: Address an integer overflow

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Address an integer overflow

Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > > net/sunrpc/xprtrdma/svcrdmarecvfrom.c:498 xdrcheckwritechunk() > warn: potential user controlled sizeof overflow 'segcount 4 4' > > net/sunrpc/xprtrdma/svcrdmarecvfrom.c > 488 static bool xdrcheckwritechunk(struct svcrdmarecvctxt rctxt) > 489 { > 490 u32 segcount; > 491 be32 p; > 492 > 493 if (xdrstreamdecodeu32(&rctxt->rcstream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 > 496 / A bogus segcount causes this buffer overflow check to fail. / > 497 p = xdrinlinedecode(&rctxt->rcstream, > --> 498 segcount rpcrdmasegmentmaxsz sizeof(p)); > > > segcount is an untrusted u32. On 32bit systems anything >= SIZEMAX / 16 will > have an integer overflow and some those values will be accepted by > xdrinlinedecode().