Re: [PATCH] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
Leon Romanovsky <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 29 Jul 2026 18:32:03 +0900, Yehyeong Lee wrote:
> srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes
> nothing to srp_process_cred_req() and srp_process_aer_req(), which read
> fixed-size fields from the receive buffer without checking that those
> fields were received.
>
> The buffer size is max_ti_iu_len, which comes from the login response
> and is not validated. A target that advertises 8 and then sends an
> 8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the
> end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent
> back, so those bytes reach the target. SRP_AER_REQ behaves the same way
> and also reads req->lun.
>
> [...]
Applied, thanks!
[1/1] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
https://git.kernel.org/rdma/rdma/c/961ac0f0c5e414
Best regards,
--
Leon Romanovsky <[email protected]>