Re: [PATCH v5 2/3] RDMA/srpt: reject zero-length buffer descriptors

[sashiko-bot@kernel.org]

> srpt_alloc_rw_ctxs() takes each buffer descriptor length straight from the
> wire and hands it to target_alloc_sgl(), which has no length check of its
> own.
> 
> For the single descriptor of a DIRECT request, and for the last descriptor
> of an INDIRECT table, chainable is false, so a zero length makes
> sgl_alloc_order() compute nalloc zero. kmalloc_objs() answers that with
> ZERO_SIZE_PTR, which is not NULL, so the allocation looks like it
> succeeded and sg_init_table(sgl, 0) runs. That reaches sg_init_marker(),
> which does sg_mark_end(&sgl[nents - 1]) with nents unsigned, so the index
> is 4294967295 rather than minus one and the read modify write of page_link
> lands far outside any allocation.
> 
>   Oops: general protection fault, probably for non-canonical address 0xdffffc03fffffffe: 0000 [#1] KASAN PTI
>   KASAN: probably user-memory-access in range [0x0000001ffffffff0-0x0000001ffffffff7]
> [ ... ]
> been allocated yet.
> 
> Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025013748.3755639-1-yhlee@isslab.korea.ac.kr?part=2