In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Repost Receive buffers for malformed replies<\/p>\n
rpcrdma_wc_receive() decrements the transport’s Receive count for
\nevery completion before it dispatches a successful Receive to
\nrpcrdma_reply_handler(). The handler must post a replacement
\nReceive WR before returning unless ownership of the rep has moved
\nelsewhere, as on the backchannel path.<\/p>\n
Commit 2ae50ad68cd7 (“xprtrdma: Close window between waking RPC
\nsenders and posting Receives”) moved the Receive refill out of
\nrpcrdma_wc_receive(), where it had run ahead of every reply, into
\nrpcrdma_reply_handler() so that the responder’s credit grant could
\nbe parsed before reposting. The bad-version and short-reply exits
\nnever reach that refill: they recycle the rep and return without
\ncalling rpcrdma_post_recvs().<\/p>\n
A remote peer can therefore drain the client’s posted Receive
\nqueue by sending a sustained stream of replies that are shorter
\nthan the fixed transport header or that carry an unrecognized
\nRPC\/RDMA version. Each such reply consumes one posted Receive
\nwithout replacing it. Once the queue empties, the peer’s next
\nSend finds no posted Receive and the transport stalls until
\nreconnect.<\/p>\n
Route both malformed-reply exits through the shared repost tail
\nafter recycling the rep, refilling against buf->rb_credits, the
\nmost recent accepted credit grant. Neither exit updates the
\ncongestion window, so RPCs admitted under the previous grant
\nremain in flight awaiting replies. A smaller refill target would
\nlet a stream of malformed replies ratchet the posted Receive count
\ndown to the batch floor while the congestion window still admits
\nrb_credits RPCs; a burst of valid replies to those RPCs could then
\noverrun the posted Receives, and because the client connects with
\nrnr_retry_count of zero, a single RNR NAK terminates the
\nconnection. Refilling against rb_credits also restores the target
\nthat applied to malformed replies before commit 2ae50ad68cd7
\n(“xprtrdma: Close window between waking RPC senders and posting
\nReceives”) when rpcrdma_post_recvs() computed it from rb_credits
\ninternally. rb_credits is at least one from connection
\nestablishment onward, so the repost path always keeps Receives
\nposted.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Repost Receive buffers for malformed replies<\/p>\n
rpcrdma_wc_receive() decrements the transport’s Receive count for
\nevery com<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7129","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}