Re: [PATCH] rds: fix out-of-bounds conn_path walk in peer gen update

[Allison Henderson]

On Fri, 2026-10-09 at 00:40 +0800, Henry Martin wrote:
> A connection on the IB transport (t_mp_capable unset) is allocated
> with exactly one rds_conn_path slot, yet the peer's genetic number
> update routine is hardcoded to walk RDS_MPATH_WORKERS entries whenever
> the peer announces a non-zero gen number that differs from the one we
> cached.  Everything past the first entry lands on whatever happens to
> follow the single-slot array in the same slab slot group, and the loop
> then reads and modifies struct fields there (lock acquired,
> cp_next_tx_seq cleared, retransmit list inspected).  A malicious peer
> can therefore force consecutive out-of-bounds writes into neighbouring
> kmalloc-512 objects (KASAN: "Write of size 4 in
> _raw_spin_lock_irqsave").
> 
> The allocation and the walk now agree on the same expression
> (trans->t_mp_capable ? RDS_MPATH_WORKERS : 1), so the loop can never
> outlive the array regardless of what the peer reports.
> 
> This vulnerability was discovered by Tencent CodeBuddy Security.

Hi Henry,

Please see my reply to the NPATHS patch:
https://lore.kernel.org/netdev/20261008163843.957325-1-bsdhenrymartin@xxxxxxxxx/

We should fold this patch into a single v2 from that thread.

Thank you!
Allison

pw-bot: cr


> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: ba3d1f480c7a ("net/rds: size a connection's path set by the transport it ends up with")
> Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
> ---
>  net/rds/recv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> --- a/net/rds/recv.c
> +++ b/net/rds/recv.c
> @@ -144,7 +144,8 @@
>  	if (peer_gen_num != 0) {
>  		if (conn->c_peer_gen_num != 0 &&
>  		    peer_gen_num != conn->c_peer_gen_num) {
> -			for (i = 0; i < RDS_MPATH_WORKERS; i++) {
> +			for (i = 0; i < (conn->c_trans->t_mp_capable ?
> +			     RDS_MPATH_WORKERS : 1); i++) {
>  				struct rds_conn_path *cp;
> 
>  				cp = &conn->c_path[i];
> --
> 2.43.7