In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-rdma: handle inline data with a nonzero offset<\/p>\n
nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
\ninto the per-command inline scatterlist. The bounds check admits any
\noffset with off + len offset = off;
\n\tsg->length = min_t(int, len, PAGE_SIZE – off);<\/p>\n
When a port is configured with inline_data_size > PAGE_SIZE (settable up
\nto max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]
\nmakes “PAGE_SIZE – off” underflow, so sg->length is set to ~4 GiB and
\nthe block backend reads far past the first inline page. num_pages(len)
\nalso ignores the offset, so an in-bounds offset whose [off, off+len)
\nspan crosses a page boundary under-counts the scatterlist.<\/p>\n
Map the offset properly: split it into a page index and an in-page
\noffset, start the scatterlist at that page, and size the page count from
\npage_off + len. Because the request scatterlist may now start at
\ninline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL
\nidentity test in nvmet_rdma_release_rsp() to a range test; otherwise the
\npersistent inline scatterlist is mistaken for an allocated one and
\nnvmet_req_free_sgls() frees an inline page (and warns in
\nfree_large_kmalloc()).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-rdma: handle inline data with a nonzero offset<\/p>\n
nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
\ninto t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6793","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}