[PATCH] RDMA/rtrs-srv: reject info requests with a non NUL-terminated pathname

process_info_req() treats the pathname received in an info request as
a NUL-terminated C string.  Only the minimum message size is validated
before it is handed to strchr(), strlen() (through exist_pathname())
and pr_err("%s").  A client that sends a message whose pathname field
is completely filled with non-NUL characters makes those functions
scan past the receive buffer into adjacent slab memory.  Since RTRS
connections require no authentication, this can be triggered by any
host able to reach the RDMA fabric.

The path is: a client posts the info request as an RDMA SEND, the
server's receive completion runs rtrs_srv_info_req_done(), which calls
process_info_req() on the received message.  The receive buffer is
allocated with kzalloc() at exactly sizeof(struct rtrs_msg_info_req),
so after scanning the 15 reserved trailing bytes of the message the
string functions walk past the end of the object, which KASAN reports
as an out-of-bounds read.

Reject info requests whose pathname is not NUL-terminated within the
pathname field.

Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
Reported-by: Abaci <[email protected]>
Assisted-by: abaci:qwen3.8-max
Signed-off-by: Chuyf26 <[email protected]>
---
 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
index 10061b218758..b500ec0be82e 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -811,6 +811,11 @@ static int process_info_req(struct rtrs_srv_con *con,
 		return err;
 	}
 
+	if (!memchr(msg->pathname, '\0', sizeof(msg->pathname))) {
+		rtrs_err(s, "pathname is not NUL terminated\n");
+		return -EINVAL;
+	}
+
 	if (strchr(msg->pathname, '/') || strchr(msg->pathname, '.')) {
 		rtrs_err(s, "pathname cannot contain / and .\n");
 		return -EINVAL;
-- 
2.43.5