Re: [PATCH v4] RDMA/srpt: Prevent uninitialized read buffer disclosure

[sashiko-bot@kernel.org]

> From: Yong Liu <pkfxxxing@gmail.com>
> 
> SRPT allocates read buffers and creates RDMA contexts from the
> initiator's descriptors before parsing the CDB. When target core reduces
> cmd->data_length, a backend such as rd_mcp fills only the shorter
> length, but the prebuilt RDMA transfer still sends the full buffer.
> Control CDB handlers can also leave bytes within cmd->data_length
> unwritten, while target core only clears the first SG entry of these
> preallocated buffers. Both cases can disclose stale target kernel memory
> to a remote initiator with access to the LUN.
> 
> Reject indirect descriptor tables whose direct descriptor lengths do not
> sum to the advertised total before allocating RDMA contexts. Also
> initialize commands rejected during descriptor parsing so the BUSY
> response path has valid callbacks and a command reference.
> 
> Save the original buffer length and zero the entire control read buffer
> before command execution. For data READs, zero any tail beyond
> cmd->data_length before posting the existing RDMA transfers. Synchronize
> each mapped SG list for device access in the response path.
> 
> The issue was discovered by Qihoo 360's Tulongfeng multi-agent system.
> 
> Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> Fixes: 8b8807b9e982 ("scsi: RDMA/srpt: Fix handling of command / TMF submission failure")
> Cc: stable@vger.kernel.org
> Suggested-by: Bart Van Assche <bvanassche@acm.org>
> Signed-off-by: Yong Liu <pkfxxxing@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112094138.1390409-1-pkfxxxing@gmail.com?part=1