Re: [PATCH v5 1/3] RDMA/srpt: bound the indirect descriptor table to the IU

[sashiko-bot@kernel.org]

> srpt_get_desc_tbl() takes the number of INDIRECT descriptors from
> idb->table_desc.len, which the initiator controls, and checks it only
> against data_out_desc_cnt + data_in_desc_cnt, two more initiator fields.
> Both are u8, so the pair admits up to 510 descriptors, and nothing
> compares the table against the receive IU it has to live in.
> srpt_alloc_rw_ctxs() then walks idb->desc_list for that many entries.
> 
> With the default srp_max_req_size of 8276 the table fits as long as the
> additional CDB is short, but ADDITIONAL CDB LENGTH is an initiator field
> too, and at its maximum of 252 bytes 510 descriptors end at
> 48 + 252 + 20 + 510 * 16 = 8480, which is past the end of the object.
> 
>   BUG: KASAN: slab-out-of-bounds in srpt_alloc_rw_ctxs+0x631/0x870
>   Read of size 4 at addr ffff888002d6a05c by task kunit_try_catch/43
> 
> [ ... ]
> offset and covers the header as well.
> 
> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025013748.3755639-1-yhlee@isslab.korea.ac.kr?part=1