Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to < 4780f58672ee6328accd54a95f9c00683477e499affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 79a20a8e201a779224b4bf115250a7713bde72c0affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 9f8f0d2099e3de1194e37dc933ae0c4206b09aafaffectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 192a3be0e3759daa24af2841208b074ca6dbaabcaffectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 424d51d33c7541a86934067c2c0538124687fc90affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < abd27a977b419d584efa659488c22d2306987b29affectedb48c24c2d710cf34810c555dcef883a3d35a9c08 to < 5ebb3ed757be3e04cf803026004aa0beaeb13e9baffected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499 ↗
- https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0 ↗
- https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf ↗
- https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc ↗
- https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90 ↗
- https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29 ↗
- https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b ↗