Re: [PATCH v5 3/3] RDMA/srpt: Prevent uninitialized read buffer disclosure

[sashiko-bot@kernel.org]

> SRPT allocates read buffers and creates RDMA contexts from the initiator's
> descriptors before parsing the CDB. When target core shortens
> cmd->data_length, a backend such as rd_mcp fills only the shorter length,
> but the prebuilt RDMA transfer still sends the full buffer. This can
> disclose stale target kernel memory to a remote initiator with access to
> the LUN.
> 
> Reject indirect descriptor tables whose direct descriptor lengths do not
> sum to the advertised total, and log the mismatch before allocating RDMA
> contexts. Save the original buffer length and zero the tail beyond
> cmd->data_length through the chained command scatterlist before posting
> RDMA transfers. This applies to both data and control READ commands.
> 
> The issue was discovered by Qihoo 360's Tulongfeng multi-agent system.
> 
> Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> Cc: stable@vger.kernel.org
> Suggested-by: Bart Van Assche <bvanassche@acm.org>
> Signed-off-by: Yong Liu <pkfxxxing@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113083848.1517595-1-pkfxxxing@gmail.com?part=3