In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Fix offset arithmetic in read_chunk_range<\/p>\n
svc_rdma_read_chunk_range() walks a Read chunk’s segment list to
\nbuild a sub-range starting at byte offset and spanning length bytes
\nfor a Position-Zero or Call chunk. Two arithmetic defects in the
\nper-segment loop produce wrong DMA lengths and a u32 underflow:<\/p>\n
pcl_for_each_segment(segment, chunk) {
\n if (offset > segment->rs_length) {
\n offset -= segment->rs_length;
\n continue;
\n }<\/p>\n
dummy.rs_handle = segment->rs_handle;
\n dummy.rs_length = min_t(u32, length,
\n segment->rs_length) – offset;
\n dummy.rs_offset = segment->rs_offset + offset;<\/p>\n
First, the skip predicate uses ‘>’ instead of ‘>=’. When offset
\nequals the segment’s full rs_length, the segment is fully consumed
\nand should be skipped, but the loop falls through into the body.
\nThe resulting dummy.rs_length is min_t(u32, length, rs_length) –
\nrs_length, which underflows to a near-UINT_MAX u32 when length is
\nsmaller than rs_length, or is zero otherwise.<\/p>\n
Second, the length formula subtracts offset from the min_t() result
\nrather than from segment->rs_length before the cap. For offset > 0
\nthe segment’s residual is rs_length – offset, not rs_length, so the
\ncap must be applied to the residual. With the current bracketing,
\nwhenever length is smaller than rs_length – offset the per-segment
\nlength becomes length – offset instead of length, silently dropping
\noffset bytes from the rebuilt chunk. Combined with the boundary
\ncase above it also enables the u32 underflow path, which propagates
\na huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB
\nkmalloc_array_node() in svc_rdma_get_rw_ctxt().<\/p>\n
Additionally, svc_rdma_read_call_chunk() can invoke this function
\nwith length == 0 when the last Read chunk ends exactly at the end
\nof the Call chunk. With the corrected >= predicate, every segment
\nis skipped and the function returns the initial -EINVAL, rejecting
\na valid request. Return success immediately when length is zero.
\nAlso break out of the loop once length is fully consumed to avoid
\npassing zero-length segments to svc_rdma_build_read_segment().<\/p>\n
Fix by using ‘>=’ so a fully-consumed segment is skipped, by
\nmoving ‘- offset’ inside min_t() so the cap is applied to the
\nsegment’s residual length, by returning success for zero-length
\nrequests, and by stopping iteration when the requested range has
\nbeen consumed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Fix offset arithmetic in read_chunk_range<\/p>\n
svc_rdma_read_chunk_range() walks a Read chunk’s segment list to
\nbuild a sub-ra<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21455","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}