【openEuler 1.0-LTS】UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:545:23 · Issue #I6WB6P · openEuler/kernel - Gitee.com

开源项目 > 其他开源 > 操作系统 &&

/ 详情

已完成

任务

创建于

2023-04-17 14:30

【严重程度】一般
【特性】
【重现类型】
【定位分析】

static void tcp_init_buffer_space(struct sock *sk)

{

int tcp_app_win = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_app_win); //读取配置

struct tcp_sock *tp = tcp_sk(sk);

int maxwin;

....

maxwin = tcp_full_space(sk);

if (tp->window_clamp >= maxwin) {

tp->window_clamp = maxwin;

if (tcp_app_win && maxwin > 4 * tp->advmss)

tp->window_clamp = max(maxwin -

(maxwin >> tcp_app_win),//右移

4 * tp->advmss);

}

maxwin是个int类型的变量，右移有效范围是[0,31], 超出此范围则是未定义行为，会触发UBSAN告

【影响评估及测试建议】 None
【对外部影响描述】 None

【严重程度】 一般
【特性】 
【重现类型】 
【定位分析】 </p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">static void tcp_init_buffer_space(struct sock *sk)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">        int tcp_app_win = READ_ONCE(sock_net(sk)-&gt;ipv4.sysctl_tcp_app_win); //读取配置</div><div class="ql-code-block" data-language="plain">        struct tcp_sock *tp = tcp_sk(sk);</div><div class="ql-code-block" data-language="plain">        int maxwin;</div><div class="ql-code-block" data-language="plain">....</div><div class="ql-code-block" data-language="plain">        maxwin = tcp_full_space(sk);</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">        if (tp-&gt;window_clamp &gt;= maxwin) {</div><div class="ql-code-block" data-language="plain">                tp-&gt;window_clamp = maxwin;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">                if (tcp_app_win &amp;&amp; maxwin &gt; 4 * tp-&gt;advmss)</div><div class="ql-code-block" data-language="plain">                        tp-&gt;window_clamp = max(maxwin -</div><div class="ql-code-block" data-language="plain">                                               (maxwin &gt;&gt; tcp_app_win),//右移</div><div class="ql-code-block" data-language="plain">                                               4 * tp-&gt;advmss);</div><div class="ql-code-block" data-language="plain">        }</div><div class="ql-code-block" data-language="plain">maxwin是个int类型的变量，右移有效范围是[0,31], 超出此范围则是未定义行为，会触发UBSAN告</div></div><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">
【影响评估及测试建议】 None
【对外部影响描述】 None

创建了任务

Hi zhixiuzhou, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers: @YangYingliang , @成坚 (CHENG Jian) , @jiaoff , @刘勇强 , @wangxiongfeng , @朱科潜 , @WangShaoBo , @lujialin , @Xu Kuohai , @冷嘲啊 , @Lingmingqiang , @yuzenghui , @juntian , @OSSIM , @陈结松 , @whoisxxx , @koulihong , @刘恺 , @hanjun-guo , @woqidaideshi , @Chiqijun , @Kefeng , @ThunderTown , @AlexGuo , @kylin-mayukun , @Zheng Zucheng , @柳歆 , @Jackie Liu , @zhujianwei001 , @郑振鹏 , @SuperSix173 , @colyli , @Zhang Yi , @htforge , @Qiuuuuu , @Yuehaibing , @xiehaocheng , @guzitao , @CTC-Xibo.Wang , @zhanghongchen , @chen wei , @Jason Zeng , @苟浩 , @DuanqiangWen , @georgeguo , @毛泓博 , @AllenShi , @zhangjialin , @Wei Li , @tcc@hello , @谭小飞 , @Fred Kimmy , @LiYihang , @young1c , @hucz , @WangBoe2022 , @chenke , @李力军 , @Yang Shen , @wsoydl , @sanglipeng , @zhangchangzhong , @jimmy_hero , @YGN-NDWD-Official , @Xie XiuQi , @zhengzengkai

添加了

sig/Kernel

标签

修改了标题

修改了标题

关联了openeuler/kernel Commit 091ae3d

关联了src-openEuler/kernel Pull Request !1019

关联了src-openEuler/kernel Pull Request !1018

通过src-openeuler/kernel Pull Request !1019 将任务状态从 待办的 修改为已完成

关联了openeuler/kernel Commit bb54ca9

关联了openEuler/kernel Pull Request !962

关联了openEuler/kernel Pull Request !963

关联了openEuler/kernel Pull Request !964

关联了openeuler/kernel Commit 2038853

关联了openeuler/kernel Commit 51ab0af

关联了openeuler/kernel Commit f3df2fe

关联了src-openEuler/kernel Pull Request !1062

关联了src-openEuler/kernel Pull Request !1063

关联了src-openEuler/kernel Pull Request !1065

登录后才可以发表评论

状态

负责人

项目

里程碑

Pull Requests

关联的 Pull Requests 被合并后可能会关闭此 issue

分支

开始日期 - 截止日期

-

置顶选项

优先级

预计工期（小时）

参与者（2）

C

1

https://gitee.com/openeuler/kernel.git

git@gitee.com:openeuler/kernel.git

openeuler

kernel

kernel