From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBF6E169AD2 for ; Tue, 16 Jun 2026 16:54:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781628899; cv=none; b=f34urMIefIVr0ejWlBuuSdG22ZQLXctr8fYIEdXIWZzEufpWEWgdDsTmuDAQvdvjZb69N4hH1Dgn0tRczBwneymqTQJA3b5dMod04ojM+9XgOC8hEVcYLn6WlzQKq3HB0s8L88rXGb3ygVaVMRwowAmcS1btJncMmdqOZ16L3Gc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781628899; c=relaxed/simple; bh=6hat5+8vR6sH5hwpRtclSnvBpCW++LLkr0Bw3mrJ7YE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=B62XxKVWuUfornxWkJ6h+NJpdl5CwRZnzJhuC/YaKiJuUODFH6RzeD4iICpOdwFoO3DtkTy/TCYeA9NaXRB2G3RtMdd3xln4u5T/D6jUDX2i0qha8FLM6XmFKZZkPQiPbYDDlW7kc3cXk5AVllogOy1UemoZM1FQWRjqhRxtjuA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cnJTTwrj; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cnJTTwrj" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2c6ab886da6so3946335ad.0 for ; Tue, 16 Jun 2026 09:54:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781628897; x=1782233697; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=pJhUJyY1o94pDseZLihc3mmdqQnwkfgxQLMjsWZTRYA=; b=cnJTTwrjBqHkTIfF882c6M0EH3YcLdV9TtokEvxlXgLlnTTFiLp9Qx8kWryHDrCEaA U6lWLYiy9dilJgdNLOob827YOnJnxbQtm4yXZywrg5mLgb0yiKHyyz5xSL2dMYrkTeNC p91cH1zPl4JSPrZXpn+ARCMA0CgWgQ1jqXh9bXljGJsMCqdPhERqcVhB5jhiKZHVTpqj HLniqlNN2IhPFjCXiKwKqOXp3619lQOmZe+TKUeHQz2F1WSIg6pC+9HzYpfPl0iJwzkc QLzDcSu/UDU3bsxNuYJvxE3InK39OGC8CEln80+MAG0SBIukU7E4Z6pSLnWFdvB1ICVO FaKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781628897; x=1782233697; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pJhUJyY1o94pDseZLihc3mmdqQnwkfgxQLMjsWZTRYA=; b=EfPDI+MM3KXMeCNudK24jWoKVsgkxEVozhJg7DBQdfsLKkm5mCFlURrhvAAR3hyz8r k0HC8zssKoySQH0qbrUvYV8u/UtzOoX1km4BiK7BHcwrsAY1GVnqgxai55rN01ph60ph t2FkwVMGt124QmTE1M11okqhCw8AB44eaI0Rm9RoOwe1J6+RRx5gkrcJG7/9Kdo8bsro YGqPwTa7U/tx1GxkpqC0NBBBvQV4G9khmapPYR6tpQiKErQT8pFfv8eKteAkv3YknXa0 H6+7YrJt6XmhlT3R9/LEeg2grUyyhJF70glPCJLs070sueP5uNYAfr7jbxaH2fdAQi2P W4RA== X-Forwarded-Encrypted: i=1; AFNElJ9Y5m/PSQnYaRaOnQ4YOdOUVhk+tnfWipSjTH5gMTSQDpVnFrL2a/jcVrxK+O2pJ/G90mlJ/MD6oAv4tBk=@vger.kernel.org X-Gm-Message-State: AOJu0Yzl+JOWFzddru+yzKSNejo2R5Uuba9o+JjNSsbXVXzcGUVeZNBw SLxgaYwz8to60iw1kJ5NdyQLIQD0OXkfzYEthL4NREakGYd2gL+otAKV X-Gm-Gg: Acq92OHNrIVgW9w7cNuX4Ag4V1phwh+Nb5zuPlg1ZOjFDPlKw6Tz1n6Alqrfqbf0FTI fDs/N2K+pGL4DwjP/GPuxGh9QX0hqdJT167rJkzV7F1E6V+X09Q6xCceu5ec09RJO+h+CDr5iXC 3BfCIhSPoyMkpaIKkUmW8GQ9Uh9S2atrBpC8HO/JBDuGbeFHhwq9Gya4ChXYp+jjv94gUKfOUnW 4wIOJPqoEEcXzg96gRA4uu+r1icq5Z6rYaxe/xMEoTXMfGFtc2CoRoU9hJGn/3MgCVzCUETFq/L G1PqWWj+OKbm3SuBaApSkYjYfnI9CWfkWGwm7IxgDPP1/KvxbvwK3BYL1W5CUuwMXvdTtTzYEpv yDSJAKd8WHhqiOL4a32hT37C0/GCNeSUSjbiEB5Jy3UUI6ZglMyz2O04xijzHuHqrRkdGe+viXA hriEhF7oJEHabVfnRkCIkEf6TwTciQsr8L4/p8Vx8= X-Received: by 2002:a17:903:1448:b0:2c6:a99a:52b5 with SMTP id d9443c01a7336-2c6a99a54b8mr20399395ad.12.1781628897049; Tue, 16 Jun 2026 09:54:57 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([36.21.199.25]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c432c8dd4bsm144760795ad.60.2026.06.16.09.54.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 09:54:56 -0700 (PDT) From: Zhenhao Wan Date: Wed, 17 Jun 2026 00:52:00 +0800 Subject: [PATCH] RDMA/rtrs-srv: Reject usr_len larger than off in process_{read,write} Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260617-rtrs-srv-usr-len-underflow-v1-1-942e6414150a@gmail.com> X-B4-Tracking: v=1; b=H4sIAC9/MWoC/yXMwQqDMAwA0F+RnBdoC7ZuvzJ22DTViNSRWDcQ/ 926Hd/lbaAkTAq3agOhlZXnVGAvFbTDM/WE3BWDM84bbwPKIooqK2YVnChhTh1JnOYPUm1NcDH 4a1NDCd5Ckb+//P74W/NrpHY5R9j3A9lCw15+AAAA X-Change-ID: 20260617-rtrs-srv-usr-len-underflow-e51072f76985 To: "Md. Haris Iqbal" , Jack Wang , Jason Gunthorpe , Leon Romanovsky , Danil Kipnis Cc: Jack Wang , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Zhenhao Wan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1781628889; l=2659; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=6hat5+8vR6sH5hwpRtclSnvBpCW++LLkr0Bw3mrJ7YE=; b=I8094tBOYajXXPZzC8+1/pMMZbaGFlrDenRIxKdBWd0C2vZYoxSpKP1mNCIbI6fvxZiN/QbOn lAYI0xZ5xY7BlItEoc25kudLN+Rnk39imls5jdM7lhZc86C35DWMjyr X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= process_read() and process_write() derive the data length of an I/O request as: usr_len = le16_to_cpu(req->usr_len); data_len = off - usr_len; off comes from the RDMA-Write-with-imm immediate and is only bounded above (off < max_chunk_size) in rtrs_srv_rdma_done(). usr_len is read from the chunk buffer the remote peer fills over RDMA, so it is peer controlled over the full u16 range and is not checked against off. If a peer sends usr_len > off, the size_t subtraction underflows and the pointer data + data_len passed to the ->rdma_ev() callback points before the chunk. The in-tree consumer rnbd_srv_rdma_ev() dereferences it as the message header (le16_to_cpu(hdr->type)) before validating it; this is an out-of-bounds read reachable from a remote peer. Reject usr_len > off before computing data_len in both paths, via the existing send_err_msg path. For a well-formed request off is the total length data_len + usr_len, so usr_len <= off holds and valid requests are unaffected. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c index 6482ad859bd1..ec3f6c2fb0b9 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c @@ -1067,6 +1067,13 @@ static void process_read(struct rtrs_srv_con *con, id->msg_id = buf_id; id->rd_msg = msg; usr_len = le16_to_cpu(msg->usr_len); + if (usr_len > off) { + rtrs_err_rl(s, + "Processing read request failed, invalid usr_len %zu > off %u\n", + usr_len, off); + ret = -EINVAL; + goto send_err_msg; + } data_len = off - usr_len; data = page_address(srv->chunks[buf_id]); ret = ctx->ops.rdma_ev(srv->priv, id, data, data_len, @@ -1120,6 +1127,13 @@ static void process_write(struct rtrs_srv_con *con, id->msg_id = buf_id; usr_len = le16_to_cpu(req->usr_len); + if (usr_len > off) { + rtrs_err_rl(s, + "Processing write request failed, invalid usr_len %zu > off %u\n", + usr_len, off); + ret = -EINVAL; + goto send_err_msg; + } data_len = off - usr_len; data = page_address(srv->chunks[buf_id]); ret = ctx->ops.rdma_ev(srv->priv, id, data, data_len, --- base-commit: a48671671df5158a0b8e564cd509e04a090a941b change-id: 20260617-rtrs-srv-usr-len-underflow-e51072f76985 Best regards, -- Zhenhao Wan