From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 81806416CEB for ; Tue, 9 Jun 2026 12:26:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781007977; cv=none; b=GEUi9ASCdc/SrOCpGQO/zTwIw06joDH6DZBnjRji0CtnJaXIgw5Zi1NyVU5LmyVNjHFsUbUpyzVKRmDUuNo5kE6ZXHgfVHCG5s/HFRpejmRjAzP0PRh4MPdoTfjT++P9V7G3sjMxFvGJQQtnZh6RGCfo95Xte26WaB/h9l21sng= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781007977; c=relaxed/simple; bh=wg5KfvkGBJNvGd0MWs43BdkFHptkMECOQ8h3CcxWTUY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UYCllUO+B/ZXyFXwLVG8lbSukBR0rdpEqdURUAsK5TnCGQNXYaLe2VsXSVy2lqP02B4WYDNxbLRf0fV6MlXCZJ6j6pR7akoj2RxAyqYQUmUNXIUsf93YrgAmWDyY68CQgIwPJG5jaRRPoA430r4A2dlgTPaoX0APcdA+2HY7aOk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=B0XHQq8K; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="B0XHQq8K" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39E801F00898; Tue, 9 Jun 2026 12:26:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781007973; bh=WvZfOdtJKxhBwrGi7Pf3HRHhPTqHib3UxRD8hBV+Bp4=; h=From:To:Cc:Subject:Date:Reply-To; b=B0XHQq8K8feoxLdUP1WeueQtmiRebbPLt3rZ5MN7nDt69/FchgJWHBa6DoEHbmran J5NaAIwRyeRCNCmcolCIq4Ps7UtboZYng3PRb5xfK/oO0TtTUmKzxk3qogd+xrSHva SoR+O5rMrb4durGHtYY1JZDr2pw6iu/hCCHd8/SY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46325: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE Date: Tue, 9 Jun 2026 14:25:08 +0200 Message-ID: <2026060907-CVE-2026-46325-d8bb@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4686; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=p7CJJ/bCLWasNmLB0OxnvD/23/DZvJVu7vS0LHhUp+U=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkabMpMupMmCj/hvXKrZuX0Q+IF2+e2rzX8mHbdXLrhy fz2TXHBHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR0mCGueKFj6/GZ6W/Zixx DPOP57ew6bWczLBgzbL1uZXbRY2aNiyrj/25cOI3Ue9nAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/ The Linux kernel CVE team has assigned CVE-2026-46325 to this issue. Affected and fixed versions =========================== Issue introduced in 6.3 with commit 592627ccbdff0ec6fff00fc761142a76db750dd4 and fixed in 6.18.14 with commit 409c2c5508f3d30627bea576f8676de523cb906e Issue introduced in 6.3 with commit 592627ccbdff0ec6fff00fc761142a76db750dd4 and fixed in 6.19.4 with commit 836f6c13c9674027793f720be3f15ecd2b90b6ca Issue introduced in 6.3 with commit 592627ccbdff0ec6fff00fc761142a76db750dd4 and fixed in 7.0 with commit 12985e5915a0b8354796efadaaeb201eed115377 Issue introduced in 6.2.3 with commit 0e443760b8b7b1e6723f4408afa056b2bc4fea12 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46325 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/sw/rxe/rxe_mr.c drivers/infiniband/sw/rxe/rxe_verbs.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377