In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE<\/p>\n
The current implementation incorrectly handles memory regions (MRs) with
\npage sizes different from the system PAGE_SIZE. The core issue is that
\nrxe_set_page() is called with mr->page_size step increments, but the
\npage_list stores individual struct page pointers, each representing
\nPAGE_SIZE of memory.<\/p>\n
ib_sg_to_page() has ensured that when i>=1 either
\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous
\nor
\nb) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned.<\/p>\n
This leads to incorrect iova-to-va conversion in scenarios:<\/p>\n
1) page_size iova = 0x181800
\n sg[0]: dma_addr=0x181800, len=0x800
\n sg[1]: dma_addr=0x173000, len=0x1000<\/p>\n
Access iova = 0x181800 + 0x810 = 0x182010
\n Expected VA: 0x173010 (second SG, offset 0x10)
\n Before fix:
\n – index = (0x182010 >> 12) – (0x181800 >> 12) = 1
\n – page_offset = 0x182010 & 0xFFF = 0x10
\n – xarray[1] stores system page base 0x170000
\n – Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)<\/p>\n
2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K):
\n ibmr->iova = 0x18f800
\n sg[0]: dma_addr=0x18f800, len=0x800
\n sg[1]: dma_addr=0x170000, len=0x1000<\/p>\n
Access iova = 0x18f800 + 0x810 = 0x190010
\n Expected VA: 0x170010 (second SG, offset 0x10)
\n Before fix:
\n – index = (0x190010 >> 16) – (0x18f800 >> 16) = 1
\n – page_offset = 0x190010 & 0xFFFF = 0x10
\n – xarray[1] stores system page for dma_addr 0x170000
\n – Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)<\/p>\n
Yi Zhang reported a kernel panic[1] years ago related to this defect.<\/p>\n
Solution:
\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential
\n indexing (all MR page indices are contiguous)
\n2. Each rxe_mr_page stores both struct page* and offset within the
\n system page
\n3. Handle MR page_size != PAGE_SIZE relationships:
\n – page_size > PAGE_SIZE: Split MR pages into multiple system pages
\n – page_size <= PAGE_SIZE: Store offset within system page
\n4. Add boundary checks and compatibility validation<\/p>\n
This ensures correct iova-to-va conversion regardless of MR page size
\nand system PAGE_SIZE relationship, while improving performance through
\narray-based sequential access.<\/p>\n
Tests on 4K and 64K PAGE_SIZE hosts:
\n– rdma-core\/pytests
\n $ .\/build\/bin\/run_tests.py –dev eth0_rxe
\n– blktest:
\n $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma .\/check nvme srp rnbd<\/p>\n
[1] https:\/\/lore.kernel.org\/all\/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com\/T\/<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE<\/p>\n
The current implementation incorrectly handles memory regions (<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16130","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}