Re: [PATCH] rds: fix out-of-bounds conn_path access via handshake NPATHS
flat view
From: Allison Henderson <achender@kernel.org>
Date: 2026-10-11 20:41:32
Also in:
linux-rdma, lkml, stable
On Fri, 2026-10-09 at 00:38 +0800, Henry Martin wrote:
Connections on the IB transport (t_mp_capable unset) own exactly one rds_conn_path slot, but the peer can still claim eight lanes through the NPATHS extension header of a handshake packet, and every subsequent fan-out path then treats all eight entries as real: the mp-start helper iterates conn->c_path[0..7], dereferencing cp->cp_conn, taking cp->cp_lock and queueing delayed work on cp->cp_wq at 504-byte strides into whatever comes after the single allocated slot (KASAN: "Read of size 8 in rds_conn_path_connect_if_down"). The negotiated lane count is now clamped to the same value the transport was allocated with (trans->t_mp_capable ? RDS_MPATH_WORKERS : 1), so a peer can never ask us to walk lanes that do not exist. This vulnerability was discovered by Tencent CodeBuddy Security.
Hi Henry,
Thanks for the patches. This patch looked a little familiar, and it turns out this fix and the
companion patch ("fix out-of-bounds conn_path walk in peer gen update") are the same fix Paula
posted in August:
https://lore.kernel.org/netdev/20260825120132.51636-1-pamoutafpro@gmail.com/ (local)
The AI review of that version came back with some complaints:
https://lore.kernel.org/netdev/20260828230506.385788-1-kuba@kernel.org/ (local)
The good news is, I think the fix is a very simple port of a uek patch:
https://github.com/oracle/linux-uek/commit/2fdeb0513f18
If your willing to step in where this series left off, you'll want to start with the v2 thread,
and pick up the porting task described there:
https://lore.kernel.org/netdev/83915f73efb509328a3d4963b093e2cffcf9af99.camel@kernel.org/ (local)
Please send a single v2 that is just that port, against net. The fix tag ba3d1f480c7a doesnt
look like it changes the allocations. The tags you want should be:
Fixes: 840df162b3eb ("rds: reduce memory footprint for RDS when transport is RDMA")
Fixes: 905dd4184e07 ("RDS: TCP: Track peer's connection generation number")
A link to Paula's v2 would also be a nice way to credit her analysis as well.
Thanks!
Allison
quoted hunk ↗ jump to hunk
Cc: stable@vger.kernel.org Fixes: ba3d1f480c7a ("net/rds: size a connection's path set by the transport it ends up with") Signed-off-by: Henry Martin <redacted> --- net/rds/recv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)--- a/net/rds/recv.c +++ b/net/rds/recv.c@@ -224,7 +224,8 @@ /* Process extension header here */ switch (type) { case RDS_EXTHDR_NPATHS: - new_npaths = min_t(int, RDS_MPATH_WORKERS, + new_npaths = min_t(int, conn->c_trans->t_mp_capable ? + RDS_MPATH_WORKERS : 1, be16_to_cpu(buffer.rds_npaths)); break; case RDS_EXTHDR_GEN_NUM: --2.43.7