In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Reject inline replies that overflow the pull-up buffer<\/p>\n
An RPC-over-RDMA client can request a reply, such as an NFS READ
\npayload, without providing a Write list or a Reply chunk to carry
\nit. When such a reply needs more scatter\/gather entries than the
\ndevice’s Send Queue supports, svc_rdma_pull_up_needed() selects
\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole
\nreply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size
\nbytes, while the reply on this path is bounded only by the client’s
\nrequest, so svc_rdma_xb_linearize() copies past the end of the
\nbuffer and corrupts adjacent slab memory. The oversized length is
\nthen stored in sc_sges[0].length and posted, so the device also
\nreads beyond the mapped region.<\/p>\n
The SGE-exhaustion branch is the only pull-up path that can exceed
\nthe buffer: the threshold branch pulls up only replies smaller
\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device’s SGE
\nbudget are sent directly without linearization. Make
\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would
\npull up cannot fit sc_max_req_size, and fail the request with
\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping
\nthe connection.<\/p>\n
The helper no longer answers a simple yes\/no question: it now
\nreports pull-up, no pull-up, or -E2BIG for a reply too large to
\nlinearize. Rename svc_rdma_pull_up_needed() to
\nsvc_rdma_check_pull_up() so its name no longer implies a boolean
\npredicate.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Reject inline replies that overflow the pull-up buffer<\/p>\n
An RPC-over-RDMA client can request a reply, such as an NFS READ
\np<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21452","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}