nvmet_rdma_map_sgl_inline() takes a host-controlled offset and length from the inline SGL descriptor and bounds-checks them against the per-port inline_data_size: u64 off = le64_to_cpu(sgl->addr); u32 len = le32_to_cpu(sgl->length); ... if (off + len > rsp->queue->dev->inline_data_size) return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR; This is unsound whenever the offset is nonzero: - "off + len" is evaluated in u64 and wraps modulo 2^64. A descriptor with addr = 0xfffffffffffffe00 and length = 0x1000 wraps the sum to 0xe00 and passes the check. nvmet_rdma_use_inline_sg() then stores the offset into scatterlist::offset (unsigned int) and the block layer reads out of bounds of the inline page; a large len also makes num_pages(len) exceed NVMET_RDMA_MAX_INLINE_SGE and overruns the fixed-size inline_sg[] array. - Even computed without wrapping, inline_data_size is configurable up to max(SZ_16K, PAGE_SIZE). An offset in (PAGE_SIZE, inline_data_size] passes the bound and then "PAGE_SIZE - off" in nvmet_rdma_use_inline_sg() underflows, leaving scatterlist::length at ~4 GiB and the offset pointing past the first inline page. A nonzero inline offset is never legitimate here. nvmet advertises icdoff = 0, nvme_rdma_setup_ctrl() refuses to use a controller that reports a nonzero icdoff ("icdoff is not supported!"), and nvme_rdma_map_sg_inline() sets the inline descriptor addr to icdoff, so a compliant initiator always sends offset 0. nvmet_rdma_use_inline_sg() likewise assumes the inline data begins at the start of the first inline page (the RNIC DMAs it to page offset 0); any nonzero offset also mis-describes the scatterlist even when it is in bounds. Reject a nonzero offset directly. This closes the u64 overflow, the inline_sg[] overrun and the PAGE_SIZE - off underflow together, and is simpler than bounding the offset. Fixes: 0d5ee2b2ab4f ("nvmet-rdma: support max(16KB, PAGE_SIZE) inline data") Cc: stable@vger.kernel.org Reported-by: Bryam Vargas Signed-off-by: Bryam Vargas --- Keith, thanks for the suggested form if (off > rsp->queue->dev->inline_data_size || len > rsp->queue->dev->inline_data_size - off) It does stop the u64 overflow, but while testing it I found it is still incomplete when a port is configured with inline_data_size > PAGE_SIZE (it is settable up to max(SZ_16K, PAGE_SIZE)): an offset in (PAGE_SIZE, inline_data_size] passes that bound and then "PAGE_SIZE - off" in nvmet_rdma_use_inline_sg() underflows, leaving scatterlist::length at ~4 GiB pointing past the first inline page. The block backend then executes the out-of-bounds read (KASAN trace below). Since a compliant initiator never sends a nonzero inline offset (nvmet advertises icdoff = 0 and nvme_rdma_setup_ctrl() refuses a nonzero icdoff), rejecting off != 0 closes that case too and is even simpler, so this formal patch uses that instead of bounding the offset. Verified on a KASAN build (inline_data_size = 16384) over an rdma_rxe soft-RoCE loopback nvmet-rdma target with a block backend: - offset 0, 4 KiB inline write: succeeds, clean (control). - offset 8192, len 4096: without this patch the bounds check passes and the block backend executes the out-of-bounds read BUG: KASAN: slab-out-of-bounds in copy_folio_from_iter_atomic Read of size 4096 ... with this patch it is rejected ("invalid inline data offset!"). - offset 4095 (< PAGE_SIZE): without this patch it is in bounds but mis-describes the SGL (NVME_SC_SGL_INVALID_DATA, no OOB); with this patch it is rejected up front. - offset 0 keeps working (no regression for compliant initiators). drivers/nvme/target/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -854,7 +854,7 @@ static u16 nvmet_rdma_map_sgl_inline(struct nvmet_rdma_rsp *rsp) return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR; } - if (off + len > rsp->queue->dev->inline_data_size) { + if (off || len > rsp->queue->dev->inline_data_size) { pr_err("invalid inline data offset!\n"); return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR; } -- 2.43.0