mirror of
https://github.com/torvalds/linux.git
synced 2026-05-30 10:04:04 +02:00
1114c87aa6
atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c
unconditionally dereferences 8 bytes at payload_addr(pkt):
value = *(u64 *)payload_addr(pkt);
check_rkey() previously accepted an ATOMIC_WRITE request with pktlen ==
resid == 0 because the length validation only compared pktlen against
resid. A remote initiator that sets the RETH length to 0 therefore reaches
atomic_write_reply() with a zero-byte logical payload, and the responder
reads sizeof(u64) bytes from past the logical end of the packet into
skb->head tailroom, then writes those 8 bytes into the attacker's MR via
rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel
tailroom per probe (the other 4 bytes are the packet's own trailing ICRC).
IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is
protocol-invalid. Hoist a strict length check into check_rkey() so the
responder never reaches the unchecked dereference, and keep the existing
WRITE-family length logic for the normal RDMA WRITE path.
Reproduced on mainline with an unmodified rxe driver: a sustained
zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer
bytes into the attacker's MR, including recognisable kernel strings and
partial kernel-direct-map pointer words. With this patch applied the
responder rejects the PDU and the MR stays all-zero.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| rxe_av.c | ||
| rxe_comp.c | ||
| rxe_cq.c | ||
| rxe_hdr.h | ||
| rxe_hw_counters.c | ||
| rxe_hw_counters.h | ||
| rxe_icrc.c | ||
| rxe_loc.h | ||
| rxe_mcast.c | ||
| rxe_mmap.c | ||
| rxe_mr.c | ||
| rxe_mw.c | ||
| rxe_net.c | ||
| rxe_net.h | ||
| rxe_ns.c | ||
| rxe_ns.h | ||
| rxe_odp.c | ||
| rxe_opcode.c | ||
| rxe_opcode.h | ||
| rxe_param.h | ||
| rxe_pool.c | ||
| rxe_pool.h | ||
| rxe_qp.c | ||
| rxe_queue.c | ||
| rxe_queue.h | ||
| rxe_recv.c | ||
| rxe_req.c | ||
| rxe_resp.c | ||
| rxe_srq.c | ||
| rxe_task.c | ||
| rxe_task.h | ||
| rxe_verbs.c | ||
| rxe_verbs.h | ||
| rxe.c | ||
| rxe.h | ||