Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to < a80b3b13786e9ab1c52b31a1f16c7d6708fa9220affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 3159c6fac43dc24b34d31971884d98a7a1bf4c4baffectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < ad360a31092a870633ec255b96f50181628b4de0affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < d566002de555b18cc395012c5c1cb8682fc6d2a9affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 54cab78df0375196aaec4e3109191653d21751dfaffectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < d5aa82da8f65562da996d184686db9d0ea718b91affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 4385ddd654d90245eeb83b3cb539670ab5c85ba4affected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a80b3b13786e9ab1c52b31a1f16c7d6708fa9220 ↗
- https://git.kernel.org/stable/c/3159c6fac43dc24b34d31971884d98a7a1bf4c4b ↗
- https://git.kernel.org/stable/c/ad360a31092a870633ec255b96f50181628b4de0 ↗
- https://git.kernel.org/stable/c/d566002de555b18cc395012c5c1cb8682fc6d2a9 ↗
- https://git.kernel.org/stable/c/54cab78df0375196aaec4e3109191653d21751df ↗
- https://git.kernel.org/stable/c/d5aa82da8f65562da996d184686db9d0ea718b91 ↗
- https://git.kernel.org/stable/c/4385ddd654d90245eeb83b3cb539670ab5c85ba4 ↗