In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs<\/p>\n
The irdma_copy_user_pgaddrs function loops through all of the umem DMA
\nblocks to populate the PBLEs and will stop when either the last DMA
\nblock is reached or palloc->total_cnt is reached. The issue is that
\nthe logic for checking palloc->total_cnt would only work for non-zero
\nvalues.<\/p>\n
When irdma_setup_pbles is called with lvl==0, it
\ncalls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
\nthe only way to break out of the loop is to reach the last umem DMA
\nblock, which means it could end up going beyond the fixed size of 4
\niwmr->pgaddrmem array that is used in the lvl==0 case.<\/p>\n
In the case of QP\/CQ\/SRQ rings, the value of lvl is determined by a
\nseparate input (for example, req.cq_pages in the case of a CQ). So,
\nwe must perform explicit checking to ensure we don’t overflow the
\npgaddrmem array if the user provides a umem that consists of more
\nblocks than their provided req.cq_pages.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs<\/p>\n
The irdma_copy_user_pgaddrs function loops through all of the umem <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7344","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}