In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/iser: reject a remote invalidation of an unregistered direction<\/p>\n
A write command whose data is sent entirely as immediate data is not
\nregistered. iser_reg_mem_fastreg() takes the DMA key path and leaves
\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has
\nalready set dir[ISER_DIR_OUT].<\/p>\n
iser_check_remote_inv() looks at dir[] alone and hands the descriptor to
\niser_inv_desc(), which reads desc->sig_protected. A target that answers
\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.
\nLeaving those commands unregistered is deliberate.<\/p>\n
The same function already terminates the connection when a target sends
\na remote invalidation the initiator did not ask for. A target that
\ninvalidates a direction that was never registered is in the same class,
\nso give it the same answer.<\/p>\n
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
\n KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
\n CPU: 0 UID: 0 PID: 40 Comm: kworker\/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)
\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\n Workqueue: rxe_wq do_work
\n RIP: 0010:iser_task_rsp+0x6d6\/0xec0
\n Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04
\n RSP: 0018:ffff88811b008db8 EFLAGS: 00010202
\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848
\n RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020
\n RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0
\n R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800
\n R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000
\n FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000
\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\n CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0
\n PKRU: 55555554
\n Call Trace:<\/p>\n
__ib_process_cq+0xe1\/0x390
\n ib_poll_handler+0x6e\/0x200
\n irq_poll_softirq+0x1df\/0x480
\n ? clockevents_program_event+0x2ba\/0x860
\n ? __pfx_irq_poll_softirq+0x10\/0x10
\n handle_softirqs+0x18e\/0x590
\n ? __pfx_handle_softirqs+0x10\/0x10
\n ? __hrtimer_rearm_deferred+0x156\/0x450
\n do_softirq+0x3b\/0x60<\/p>\n
__local_bh_enable_ip+0x61\/0x70
\n __alloc_skb+0x732\/0x890
\n ? _raw_spin_lock_irqsave+0x85\/0xe0
\n ? __pfx___alloc_skb+0x10\/0x10
\n ? _raw_read_unlock_irqrestore+0x16\/0x50
\n rxe_init_packet+0x16b\/0x4f0
\n prepare_ack_packet+0xb8\/0x830
\n rxe_receiver+0x499\/0x9980
\n ? __pfx_rxe_receiver+0x10\/0x10
\n ? rxe_completer+0x29e5\/0x38c0
\n ? hrtimer_start_range_ns_common+0x75f\/0x1730
\n ? hrtimer_start_range_ns+0xa6\/0x2c0
\n ? __pfx__raw_spin_lock_irqsave+0x10\/0x10
\n ? __pfx_rxe_receiver+0x10\/0x10
\n do_work+0x144\/0x470
\n process_one_work+0x633\/0x1030
\n ? assign_work+0x11d\/0x370
\n worker_thread+0x45b\/0xd10
\n ? __pfx_worker_thread+0x10\/0x10
\n kthread+0x2c6\/0x3b0
\n ? recalc_sigpending+0x15c\/0x1e0
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork+0x36e\/0x5a0
\n ? __pfx_ret_from_fork+0x10\/0x10
\n ? __switch_to+0x572\/0xdd0
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Modules linked in:
\n —[ end trace 0000000000000000 ]—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/iser: reject a remote invalidation of an unregistered direction<\/p>\n
A write command whose data is sent entirely as immediate data i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33427","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}