【openEuler 1.0-LTS】UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:545:23

【严重程度】 一般
【特性】 
【重现类型】 
【定位分析】 </p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">static void tcp_init_buffer_space(struct sock *sk)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">        int tcp_app_win = READ_ONCE(sock_net(sk)-&gt;ipv4.sysctl_tcp_app_win); //读取配置</div><div class="ql-code-block" data-language="plain">        struct tcp_sock *tp = tcp_sk(sk);</div><div class="ql-code-block" data-language="plain">        int maxwin;</div><div class="ql-code-block" data-language="plain">....</div><div class="ql-code-block" data-language="plain">        maxwin = tcp_full_space(sk);</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">        if (tp-&gt;window_clamp &gt;= maxwin) {</div><div class="ql-code-block" data-language="plain">                tp-&gt;window_clamp = maxwin;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">                if (tcp_app_win &amp;&amp; maxwin &gt; 4 * tp-&gt;advmss)</div><div class="ql-code-block" data-language="plain">                        tp-&gt;window_clamp = max(maxwin -</div><div class="ql-code-block" data-language="plain">                                               (maxwin &gt;&gt; tcp_app_win),//右移</div><div class="ql-code-block" data-language="plain">                                               4 * tp-&gt;advmss);</div><div class="ql-code-block" data-language="plain">        }</div><div class="ql-code-block" data-language="plain">maxwin是个int类型的变量，右移有效范围是[0,31], 超出此范围则是未定义行为，会触发UBSAN告</div></div><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">
【影响评估及测试建议】 None
【对外部影响描述】 None

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler/kernelClosed

Content Risk Flag