[PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Sara Venkatesh]

imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().

Use check_add_overflow() to detect wrapping before the comparison.

Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data")
Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com>
Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
---
 drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 9aec5d80117f..f66cfd70c263 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
 		struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
 		void *data = (void *)srp_cmd + imm_data_offset;
 		uint32_t len = be32_to_cpu(imm_buf->len);
-		uint32_t req_size = imm_data_offset + len;
+		uint32_t req_size;
 
-		if (req_size > srp_max_req_size) {
+		if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
+		    req_size > srp_max_req_size) {
 			pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
 			       imm_data_offset, len, srp_max_req_size);
 			return -EINVAL;
-- 
2.43.0

Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Bart Van Assche]

On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> index 9aec5d80117f..f66cfd70c263 100644
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
>   		struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
>   		void *data = (void *)srp_cmd + imm_data_offset;
>   		uint32_t len = be32_to_cpu(imm_buf->len);
> -		uint32_t req_size = imm_data_offset + len;
> +		uint32_t req_size;
>   
> -		if (req_size > srp_max_req_size) {
> +		if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
> +		    req_size > srp_max_req_size) {
>   			pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
>   			       imm_data_offset, len, srp_max_req_size);
>   			return -EINVAL;

Do the srp tests from https://github.com/linux-blktests/blktests/ still
pass with this patch applied?

Thanks,

Bart.

Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Sara Venkatesh]

Hi Bart,

Yes, tested with blktests srp suite against this patch on 7.1.0-rc2:

srp/001 ... [passed]
srp/002 ... [passed]
srp/005 ... [passed]
srp/006 ... [passed]
srp/007 ... [passed]
srp/008 ... [passed]
srp/009 ... [passed]
srp/010 ... [passed]
srp/011 ... [passed]
srp/012 ... [passed]
srp/013 ... [passed]
srp/014 ... [passed]
srp/016 ... [passed]

srp/003 and srp/004 are [not run] (legacy device mapper support missing).

Thanks,
Sara

On 5/4/26 01:17, Bart Van Assche wrote:
> On 5/4/26 10:00 AM, Sara Venkatesh wrote:
>> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c 
>> b/drivers/infiniband/ulp/srpt/ib_srpt.c
>> index 9aec5d80117f..f66cfd70c263 100644
>> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
>> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
>> @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct 
>> srpt_recv_ioctx *recv_ioctx,
>>           struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
>>           void *data = (void *)srp_cmd + imm_data_offset;
>>           uint32_t len = be32_to_cpu(imm_buf->len);
>> -        uint32_t req_size = imm_data_offset + len;
>> +        uint32_t req_size;
>>   -        if (req_size > srp_max_req_size) {
>> +        if (check_add_overflow((uint32_t)imm_data_offset, len, 
>> &req_size) ||
>> +            req_size > srp_max_req_size) {
>>               pr_err("Immediate data (length %d + %d) exceeds request 
>> size %d\n",
>>                      imm_data_offset, len, srp_max_req_size);
>>               return -EINVAL;
>
> Do the srp tests from https://github.com/linux-blktests/blktests/ still
> pass with this patch applied?
>
> Thanks,
>
> Bart.

Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Bart Van Assche]

On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> imm_buf->len is a user-controlled uint32_t received from the network.
> Adding it to imm_data_offset without overflow checking allows a
> malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
> around to a small value, bypassing the bounds check, and subsequently
> passing a ~4GB length to sg_init_one().
> 
> Use check_add_overflow() to detect wrapping before the comparison.
Reviewed-by: Bart Van Assche <bvanassche@acm.org>