[PATCH 0/6] svcrdma: harden parsed chunk list against malformed wire values

[Chuck Lever <cel@kernel.org>]

The RPC/RDMA transport stores wire-supplied chunk positions, lengths,
and segment counts verbatim in the parsed chunk list.  Consumer
functions compute gap lengths and sub-range offsets from these values
using unsigned subtraction.  A malicious or buggy peer can supply
values that cause these subtractions to underflow, exposing slab
memory to the Reply channel or driving oversized allocations.

The fix proceeds in two layers.  Consumer functions in svc_rdma_rw.c
gain bounds checks against the saved inline body length before each
unsigned subtraction, closing the immediate underflow paths.  The
Read list decoder in svc_rdma_recvfrom.c gains a segment-length cap
against the receive context's page budget, and the existing page-
overrun guard in svc_rdma_build_read_segment() is corrected to
release the rw context it has already acquired.  These consumer-side
fixes are backportable independently.

pcl_for_each_segment() uses an inclusive upper bound that underflows
when ch_segcount is zero, turning a zero-segment Write or Reply
chunk into an unbounded memory walk.  The macro is changed to a
half-open bound that naturally produces an empty iteration for
ch_segcount == 0.  The decoder then also rejects zero-segment chunks
at the wire boundary, and reorders pcl_alloc_write() so that only
fully-populated chunks appear on the list.  The macro fix remains as
defense in depth and is safe to backport to trees without the decoder
change.

A consolidation pass validates Read chunk positions and overlap
invariants once, immediately after decoding, so that future PCL
consumers inherit the guarantee without replicating per-site checks.

---
Chris Mason (3):
      svcrdma: Fix offset arithmetic in read_chunk_range
      svcrdma: fix pcl_for_each_segment for empty chunks
      svcrdma: reject Write/Reply chunks with segcount 0

Chuck Lever (3):
      svcrdma: validate Read chunk positions before reconstruction
      svcrdma: reject oversized Read segments at decode time
      svcrdma: Validate Read chunk positions at decode time

 include/linux/sunrpc/svc_rdma_pcl.h     |  4 ++-
 net/sunrpc/xprtrdma/svc_rdma_pcl.c      | 63 ++++++++++++++++++++++++++++++---
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 14 ++++++--
 net/sunrpc/xprtrdma/svc_rdma_rw.c       | 52 ++++++++++++++++++++-------
 4 files changed, 113 insertions(+), 20 deletions(-)
---
base-commit: 887d478bb2115cec0be8caae58bad4d4b3109b1a
change-id: 20260524-rpc-kernel-bugs-fb537a0615ec

Best regards,
--  
Chuck Lever <chuck.lever@oracle.com>