In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Fix bcall rep leak and unbounded peek<\/p>\n
rpcrdma_is_bcall() decodes a reply’s first words to decide whether
\nthe frame is a backchannel call. Two issues in that decode path
\nlet a short or malformed reply leak the receive buffer and drain
\nthe Receive queue.<\/p>\n
First, the speculative peek<\/p>\n
p = xdr_inline_decode(xdr, 0);
\n \/* five p++ reads follow *\/<\/p>\n
asks xdr_inline_decode() for zero bytes, which returns xdr->p
\nwithout consulting xdr->end. The five subsequent __be32 reads can
\nthen walk up to 20 bytes past the wire payload into stale regbuf
\ncontents and misclassify the reply as a backchannel call.<\/p>\n
Second, after the post-peek<\/p>\n
p = xdr_inline_decode(xdr, 3 * sizeof(*p));
\n if (unlikely(!p))
\n return true;<\/p>\n
the short-header arm returns true without calling
\nrpcrdma_bc_receive_call(). The contract with the caller is that a
\ntrue return transfers ownership of rep to the backchannel path:<\/p>\n
rpcrdma_reply_handler()
\n if (rpcrdma_is_bcall(r_xprt, rep))
\n return; \/* bare return, skips out_post *\/
\n …
\n out_post:
\n rpcrdma_post_recvs(r_xprt, credits + …);<\/p>\n
Because rpcrdma_bc_receive_call() never ran, no one took rep, but
\nrpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()
\nand rpcrdma_post_recvs(). The rep, with its persistently
\nDMA-mapped receive buffer, is orphaned on rb_all_reps and freed
\nonly at transport teardown. This completion reposts nothing, so
\nits slot is reclaimed only when a later forward-channel reply
\nreaches out_post and rpcrdma_post_recvs() allocates a fresh rep to
\nbackfill; absent that traffic the Receive queue drains and the
\npeer’s Sends draw RNR NAKs.<\/p>\n
Fix by consulting xdr->end after the zero-length peek so the five
\n__be32 reads cannot run unless 20 bytes of wire payload remain. A
\nbyte-precise comparison against xdr->end is required because a
\nnon-4-aligned receive rounds the stream’s word count up past the
\ntrue payload. Also return false from the short-header arm so the
\nreply falls through the normal out_norqst cleanup chain
\n(rpcrdma_rep_put() plus rpcrdma_post_recvs()).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xprtrdma: Fix bcall rep leak and unbounded peek<\/p>\n
rpcrdma_is_bcall() decodes a reply’s first words to decide whether
\nthe frame is a <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7133","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}