[PATCH net v5 1/3] net/smc: bound the wire-controlled producer cursor to the RMB
From: Bryam Vargas via B4 Relay <devnull+hexlabsecurity.proton.me@kernel.org>
Date: 2026-07-24 00:23:28
Also in:
b4-sent, linux-rdma, linux-s390, lkml
Subsystem:
networking [general], shared memory communications (smc) sockets, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, D. Wythe, Dust Li, Sidraya Jayagond, Wenjia Zhang, Linus Torvalds
From: Bryam Vargas <redacted>
smcr_cdc_msg_to_host() and smcd_cdc_msg_to_host() import a peer's
producer cursor from the wire into conn->local_rx_ctrl.prod without
bounding it against the receive buffer. The urgent-data path in
smc_cdc_msg_recv_action() then uses that count as a raw index into the
RMB, so a peer that advertises a producer cursor past rmb_desc->len
reads out of bounds of the RMB allocation in the receive tasklet and
can disclose adjacent kernel memory.
Bound the producer cursor count to rmb_desc->len at the wire-to-host
conversion, for both SMC-R and SMC-D. Bound only the producer cursor:
the consumer cursor indexes the peer's RMB and is bounded by
peer_rmbe_size, so clamping it to our rmb_desc->len would under-credit
peer_rmbe_space and stall transmit to a peer with a larger RMB.
Conforming peers are unaffected.
Fixes: de8474eb9d50 ("net/smc: urgent data support")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <redacted>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
---
net/smc/smc_cdc.h | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 696cc11f2303..ca76ef630356 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h@@ -221,7 +221,8 @@ static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer, static inline void smc_cdc_cursor_to_host(union smc_host_cursor *local, union smc_cdc_cursor *peer, - struct smc_connection *conn) + struct smc_connection *conn, + int max_count) { union smc_host_cursor temp, old; union smc_cdc_cursor net;
@@ -235,6 +236,15 @@ static inline void smc_cdc_cursor_to_host(union smc_host_cursor *local, if ((old.wrap == temp.wrap) && (old.count > temp.count)) return; + /* The peer producer cursor is wire-controlled and is later used as a + * raw index into our RMB by the urgent path; bound its count to the + * RMB. max_count == 0 leaves the consumer cursor unbounded here: it + * indexes the peer's RMB (bounded by peer_rmbe_size, not our + * rmb_desc->len), so clamping it to rmb_desc->len would under-credit + * peer_rmbe_space and stall transmit to peers with a larger RMB. + */ + if (max_count && temp.count > max_count) + temp.count = max_count; smc_curs_copy(local, &temp, conn); }
@@ -246,8 +256,13 @@ static inline void smcr_cdc_msg_to_host(struct smc_host_cdc_msg *local, local->len = peer->len; local->seqno = ntohs(peer->seqno); local->token = ntohl(peer->token); - smc_cdc_cursor_to_host(&local->prod, &peer->prod, conn); - smc_cdc_cursor_to_host(&local->cons, &peer->cons, conn); + /* bound the wire-controlled producer cursor to our RMB (used as a raw + * index by the urgent path); leave the consumer cursor unbounded -- it + * indexes the peer's RMB and is bounded by peer_rmbe_size. + */ + smc_cdc_cursor_to_host(&local->prod, &peer->prod, conn, + conn->rmb_desc->len); + smc_cdc_cursor_to_host(&local->cons, &peer->cons, conn, 0); local->prod_flags = peer->prod_flags; local->conn_state_flags = peer->conn_state_flags; }
@@ -260,6 +275,12 @@ static inline void smcd_cdc_msg_to_host(struct smc_host_cdc_msg *local, temp.wrap = peer->prod.wrap; temp.count = peer->prod.count; + /* the peer producer cursor is wire-controlled and is used as a raw + * index into our RMB by the urgent path; bound it to the RMB. The + * consumer cursor below indexes the peer's RMB and is left unbounded. + */ + if (temp.count > conn->rmb_desc->len) + temp.count = conn->rmb_desc->len; smc_curs_copy(&local->prod, &temp, conn); temp.wrap = peer->cons.wrap;
--
2.55.0