Re: Potential data corruption in DDP with MSN protocol violation

On Apr 23, 2004, at 8:40 PM, Barry Reinhold wrote:

> Based on the current wording in ddp draft 02, clause 9 it appears that 
> a
> receiver can place and deliver a sequence of DDP messages that arrive
> with sequence number MSN=1, MSN=3, MSN=4 if there is no gap in the LLP
> stream sequence. This could only be generated by a protocol error on 
> the
> transmitting side.
> However, if the transmitter did indeed generate this sequence
> incorrectly it is conceivable that the receiver would have old data in 
> a
> buffer associated with MSN=2 and deliver it to the ULP.
>

The buffer associated with MSN 2 cannot be delivered unless a segment
for MSN 2 arrives with the L bit set.

It *is* possible for a sender to deliberately deliver undefined data
to a peer, by simply not sending the entire message. It is unlikely
that the receiver would take the effort to detect this (given that the
MAY be out of order even in relation to LLP sequence, they only
SHOULD be in order).

But since the buffer belonged to the Data Sink ULP anyway I
cannot imagine there being an exploit for this. Tricks involving
*system* buffers might reveal interesting data if the system
fails to zap them when assigning them to a new user. But
that's one of the problems that RDMA avoids.