Re: [PATCH 0/6] svcrdma: harden parsed chunk list against malformed wire values

[Jeff Layton <jlayton@kernel.org>]

On Tue, 2026-05-26 at 09:35 -0400, Chuck Lever wrote:
> The RPC/RDMA transport stores wire-supplied chunk positions, lengths,
> and segment counts verbatim in the parsed chunk list.  Consumer
> functions compute gap lengths and sub-range offsets from these values
> using unsigned subtraction.  A malicious or buggy peer can supply
> values that cause these subtractions to underflow, exposing slab
> memory to the Reply channel or driving oversized allocations.
> 
> The fix proceeds in two layers.  Consumer functions in svc_rdma_rw.c
> gain bounds checks against the saved inline body length before each
> unsigned subtraction, closing the immediate underflow paths.  The
> Read list decoder in svc_rdma_recvfrom.c gains a segment-length cap
> against the receive context's page budget, and the existing page-
> overrun guard in svc_rdma_build_read_segment() is corrected to
> release the rw context it has already acquired.  These consumer-side
> fixes are backportable independently.
> 
> pcl_for_each_segment() uses an inclusive upper bound that underflows
> when ch_segcount is zero, turning a zero-segment Write or Reply
> chunk into an unbounded memory walk.  The macro is changed to a
> half-open bound that naturally produces an empty iteration for
> ch_segcount == 0.  The decoder then also rejects zero-segment chunks
> at the wire boundary, and reorders pcl_alloc_write() so that only
> fully-populated chunks appear on the list.  The macro fix remains as
> defense in depth and is safe to backport to trees without the decoder
> change.
> 
> A consolidation pass validates Read chunk positions and overlap
> invariants once, immediately after decoding, so that future PCL
> consumers inherit the guarantee without replicating per-site checks.
> 
> ---
> Chris Mason (3):
>       svcrdma: Fix offset arithmetic in read_chunk_range
>       svcrdma: fix pcl_for_each_segment for empty chunks
>       svcrdma: reject Write/Reply chunks with segcount 0
> 
> Chuck Lever (3):
>       svcrdma: validate Read chunk positions before reconstruction
>       svcrdma: reject oversized Read segments at decode time
>       svcrdma: Validate Read chunk positions at decode time
> 
>  include/linux/sunrpc/svc_rdma_pcl.h     |  4 ++-
>  net/sunrpc/xprtrdma/svc_rdma_pcl.c      | 63 ++++++++++++++++++++++++++++++---
>  net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 14 ++++++--
>  net/sunrpc/xprtrdma/svc_rdma_rw.c       | 52 ++++++++++++++++++++-------
>  4 files changed, 113 insertions(+), 20 deletions(-)
> ---
> base-commit: 887d478bb2115cec0be8caae58bad4d4b3109b1a
> change-id: 20260524-rpc-kernel-bugs-fb537a0615ec
> 
> Best regards,
> --  
> Chuck Lever <chuck.lever@oracle.com>

Acked-by: Jeff Layton <jlayton@kernel.org>