Re: [PATCH] rds: fix out-of-bounds conn_path access via handshake NPATHS

[Allison Henderson <achender@kernel.org>]

On Fri, 2026-10-09 at 00:38 +0800, Henry Martin wrote:
> Connections on the IB transport (t_mp_capable unset) own exactly one
> rds_conn_path slot, but the peer can still claim eight lanes through
> the NPATHS extension header of a handshake packet, and every
> subsequent fan-out path then treats all eight entries as real: the
> mp-start helper iterates conn->c_path[0..7], dereferencing cp->cp_conn,
> taking cp->cp_lock and queueing delayed work on cp->cp_wq at 504-byte
> strides into whatever comes after the single allocated slot (KASAN:
> "Read of size 8 in rds_conn_path_connect_if_down").
> 
> The negotiated lane count is now clamped to the same value the
> transport was allocated with (trans->t_mp_capable ?
> RDS_MPATH_WORKERS : 1), so a peer can never ask us to walk lanes that
> do not exist.
> 
> This vulnerability was discovered by Tencent CodeBuddy Security.

Hi Henry,

Thanks for the patches.  This patch looked a little familiar, and it turns out this fix and the
companion patch ("fix out-of-bounds conn_path walk in peer gen update") are the same fix Paula
posted in August:

https://lore.kernel.org/netdev/20260825120132.51636-1-pamoutafpro@gmail.com/

The AI review of that version came back with some complaints:

https://lore.kernel.org/netdev/20260828230506.385788-1-kuba@kernel.org/

The good news is, I think the fix is a very simple port of a uek patch:
https://github.com/oracle/linux-uek/commit/2fdeb0513f18

If your willing to step in where this series left off, you'll want to start with the v2 thread,
and pick up the porting task described there:
https://lore.kernel.org/netdev/83915f73efb509328a3d4963b093e2cffcf9af99.camel@kernel.org/

Please send a single v2 that is just that port, against net.  The fix tag ba3d1f480c7a doesnt
look like it changes the allocations. The tags you want should be:
Fixes: 840df162b3eb ("rds: reduce memory footprint for RDS when transport is RDMA")
Fixes: 905dd4184e07 ("RDS: TCP: Track peer's connection generation number")

A link to Paula's v2 would also be a nice way to credit her analysis as well.

Thanks!
Allison

> 
> Cc: stable@vger.kernel.org
> Fixes: ba3d1f480c7a ("net/rds: size a connection's path set by the transport it ends up with")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  net/rds/recv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> --- a/net/rds/recv.c
> +++ b/net/rds/recv.c
> @@ -224,7 +224,8 @@
>  		/* Process extension header here */
>  		switch (type) {
>  		case RDS_EXTHDR_NPATHS:
> -			new_npaths = min_t(int, RDS_MPATH_WORKERS,
> +			new_npaths = min_t(int, conn->c_trans->t_mp_capable ?
> +					   RDS_MPATH_WORKERS : 1,
>  					   be16_to_cpu(buffer.rds_npaths));
>  			break;
>  		case RDS_EXTHDR_GEN_NUM:
> --
> 2.43.7