CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Fix offset arithmetic in read_chunk_range

svc_rdma_read_chunk_range() walks a Read chunk's segment list to
build a sub-range starting at byte offset and spanning length bytes
for a Position-Zero or Call chunk. Two arithmetic defects in the
per-segment loop produce wrong DMA lengths and a u32 underflow:

    pcl_for_each_segment(segment, chunk) {
            if (offset > segment->rs_length) {
                    offset -= segment->rs_length;
                    continue;
            }

            dummy.rs_handle = segment->rs_handle;
            dummy.rs_length = min_t(u32, length,
                                    segment->rs_length) - offset;
            dummy.rs_offset = segment->rs_offset + offset;

First, the skip predicate uses '>' instead of '>='. When offset
equals the segment's full rs_length, the segment is fully consumed
and should be skipped, but the loop falls through into the body.
The resulting dummy.rs_length is min_t(u32, length, rs_length) -
rs_length, which underflows to a near-UINT_MAX u32 when length is
smaller than rs_length, or is zero otherwise.

Second, the length formula subtracts offset from the min_t() result
rather than from segment->rs_length before the cap. For offset > 0
the segment's residual is rs_length - offset, not rs_length, so the
cap must be applied to the residual. With the current bracketing,
whenever length is smaller than rs_length - offset the per-segment
length becomes length - offset instead of length, silently dropping
offset bytes from the rebuilt chunk. Combined with the boundary
case above it also enables the u32 underflow path, which propagates
a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB
kmalloc_array_node() in svc_rdma_get_rw_ctxt().

Additionally, svc_rdma_read_call_chunk() can invoke this function
with length == 0 when the last Read chunk ends exactly at the end
of the Call chunk. With the corrected >= predicate, every segment
is skipped and the function returns the initial -EINVAL, rejecting
a valid request. Return success immediately when length is zero.
Also break out of the loop once length is fully consumed to avoid
passing zero-length segments to svc_rdma_build_read_segment().

Fix by using '>=' so a fully-consumed segment is skipped, by
moving '- offset' inside min_t() so the cap is applied to the
segment's residual length, by returning success for zero-length
requests, and by stopping iteration when the requested range has
been consumed.

The Linux kernel CVE team has assigned CVE-2026-89533 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 6.12.109 with commit 6ee4dc7476b3abc92ec1d444533a559f33f59561
	Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 6.18.50 with commit a46b35f213c2426f5d6a0458a8f7e873fc59cdfd
	Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 7.2.4 with commit 4493c96bbd0068fadf69cbae8d13426202e34cdc
	Issue introduced in 5.11 with commit d7cc73972661be4a02a1b09f1d9b3283c6c05154 and fixed in 7.3-rc1 with commit 4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89533
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/xprtrdma/svc_rdma_rw.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561
	https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd
	https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc
	https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e