[BUG] librdmacm: Accessing out-of-bounds memory

Korb, Andreas
2026-04-07T13:16:24Z

[-- Attachment #1: Type: text/plain, Size: 2308 bytes --]

The function `ds_init_ep` in librdmacm/rsocket.c may access memory via an object that is not allocated for this object.

Relevant lines from this function:

// (1): Prepare `struct rsocket`
ds_set_qp_size(rs);
// (2): Allocation
rs->sbuf = calloc(rs->sq_size, RS_SNDLOWAT);
// (3): Copy pointer to rs->smsg_free
rs->smsg_free = (struct ds_smsg *) rs->sbuf;
// (4): Copy pointer to msg
msg = rs->smsg_free;
// (5): Write to msg->next
msg->next = NULL;

Within my podman container:
Before (1): rs->sq_size = rs->rq_size = 384
After (1): rs->sq_size = rs->rq_size = 0
Therefore, (2) does not reserve a buffer, but still returns a pointer which can be freed later, as described by man-page calloc(3p).
(5) writes data to the buffer allocated in (2). If no actual buffer is allocated, it overwrites arbitrary data, yielding undefined
behavior.

I found it by executing /usr/bin/udpong (without any arguments) with libscudo on an arm64 server with memory tagging enabled. It
immediately crashes with a segmentation fault, then. Without memory tagging, the bug stays undetected, and execution continues.
The code behavior described above also happens on x86-64, there it doesn't result in a crash and is silently ignored because of the
lack of MemoryTagging. Valgrind also detects this violation, however.

In summary:
The libc man-page states that if the allocated buffer size is 0, then either:
> * A null pointer shall be returned and errno may be set to an
> implementation-defined value, or
> * A pointer to the allocated space shall be returned. The
> application shall ensure that the pointer is not used to
> access an object.

and the function `ds_init_ep` misses to ensure to work for the second case.

* Linux distribution and version
Debian Trixie (in podman container)

* Linux kernel and version
Linux arm01 6.12.22+bpo-arm64 #1 SMP Debian 6.12.22-1~bpo12+1 (2025-04-25) aarch64 GNU/Linux

* InfiniBand hardware and firmware version
None available in podman container

* How to reproduce
As I'm assuming most people use x86_64 machines, this shows the bug with valrind:
podman run --rm -e DEBUGINFOD_URLS="https://debuginfod.debian.net" debian:trixie bash -lc 'apt-get update && apt-get install -y
valgrind rdmacm-utils debuginfod && valgrind /usr/bin/udpong'

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 8022 bytes --]