Description
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave ep->re_write_pad_mr set to NULL. rpcrdma_xprt_connect() currently ignores that return value. If frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to encode_rdma_segment(), and dereferences it. This is locally triggerable on an NFS/RDMA client after a connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer alone cannot force the local MR setup failure. Check the return value and fail the connect as -ENOTCONN, matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path retry.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < 3b252fe1778b2cdd68283146455929801bc2abd7affected21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < dd798b76a3481e392820c3ae86ed4592858c6b0faffected21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < 6b7be4f3feae322f1c2c40a3bdc99db93574a49eaffected21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < 7471e66373a4444a57ef2192f8c4081202c54f45affected21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9affected21037b8c2258ec40de3b31be9ced43ceb3b784f7 to < 0f13fc7c7d2e0427517e63c739277a4cd338b0c5affected
Linux Linux
Default version status: affected
5.16affected0 to < 5.16unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3b252fe1778b2cdd68283146455929801bc2abd7 ↗
- https://git.kernel.org/stable/c/dd798b76a3481e392820c3ae86ed4592858c6b0f ↗
- https://git.kernel.org/stable/c/6b7be4f3feae322f1c2c40a3bdc99db93574a49e ↗
- https://git.kernel.org/stable/c/7471e66373a4444a57ef2192f8c4081202c54f45 ↗
- https://git.kernel.org/stable/c/ef3b79edf14b6bfb0d21a26ccb0463f9cf82c6a9 ↗
- https://git.kernel.org/stable/c/0f13fc7c7d2e0427517e63c739277a4cd338b0c5 ↗