Re: [PATCH v2] RDMA/srpt: Limit read data transfers to the command length

[sashiko-bot@kernel.org]

> SRPT builds RDMA contexts from the initiator's buffer descriptors before
> parsing the CDB. The resulting RDMA WRITE requests can exceed
> cmd->data_length after target core shortens the command or when an
> indirect descriptor's buffers exceed its advertised total length.
> A backend such as rd_mcp fills only cmd->data_length bytes, leaving an
> uninitialized tail that is still transferred to the initiator.
> 
> A remote initiator with access to the LUN can therefore read
> uninitialized target kernel memory beyond the requested SCSI data,
> potentially exposing sensitive data left from previous uses of those
> pages.
> 
> Limit the data SGEs in every read response to cmd->data_length without
> depending on SCF_UNDERFLOW_BIT. Keep MR operations and WR accounting
> unchanged by retaining excess RDMA WRITEs as zero-length requests.
> Clear sg_list when num_sge becomes zero so that providers such as irdma
> do not program a non-zero first fragment from the original SGE list.
> 
> The issue was discovered and fixed by Qihoo 360's Tulongfeng multi-agent
> system.
> 
> Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> Cc: stable@vger.kernel.org
> Signed-off-by: liuyong <pkfxxxing@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110052827.963143-1-pkfxxxing@gmail.com?part=1