From 13456aa440da1db604eab88dbb4c762df452e0d3 Mon Sep 17 00:00:00 2001 From: Bryam Vargas Date: Thu, 4 Jun 2026 08:46:33 +0000 Subject: [PATCH] nvmet-rdma: reject inline data with a nonzero offset nvmet_rdma_map_sgl_inline() takes a host-controlled offset and length from the inline SGL descriptor and bounds-checks them against the per-port inline_data_size: u64 off = le64_to_cpu(sgl->addr); u32 len = le32_to_cpu(sgl->length); ... if (off + len > rsp->queue->dev->inline_data_size) return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR; This is unsound whenever the offset is nonzero: - "off + len" is evaluated in u64 and wraps modulo 2^64. A descriptor with addr = 0xfffffffffffffe00 and length = 0x1000 wraps the sum to 0xe00 and passes the check. nvmet_rdma_use_inline_sg() then stores the offset into scatterlist::offset (unsigned int) and the block layer reads out of bounds of the inline page; a large len also makes num_pages(len) exceed NVMET_RDMA_MAX_INLINE_SGE and overruns the fixed-size inline_sg[] array. - Even computed without wrapping, inline_data_size is configurable up to max(SZ_16K, PAGE_SIZE). An offset in (PAGE_SIZE, inline_data_size] passes the bound and then "PAGE_SIZE - off" in nvmet_rdma_use_inline_sg() underflows, leaving scatterlist::length at ~4 GiB and the offset pointing past the first inline page. A nonzero inline offset is never legitimate here. nvmet advertises icdoff = 0, nvme_rdma_setup_ctrl() refuses to use a controller that reports a nonzero icdoff ("icdoff is not supported!"), and nvme_rdma_map_sg_inline() sets the inline descriptor addr to icdoff, so a compliant initiator always sends offset 0. nvmet_rdma_use_inline_sg() likewise assumes the inline data begins at the start of the first inline page (the RNIC DMAs it to page offset 0); any nonzero offset also mis-describes the scatterlist even when it is in bounds. Reject a nonzero offset directly. This closes the u64 overflow, the inline_sg[] overrun and the PAGE_SIZE - off underflow together, and is simpler than bounding the offset. Fixes: 0d5ee2b2ab4f ("nvmet-rdma: support max(16KB, PAGE_SIZE) inline data") Cc: stable@vger.kernel.org Reported-by: Bryam Vargas Signed-off-by: Bryam Vargas --- drivers/nvme/target/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index e6e2c3f9afdf5..0c75e1d32dd13 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -854,7 +854,7 @@ static u16 nvmet_rdma_map_sgl_inline(struct nvmet_rdma_rsp *rsp) return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR; } - if (off + len > rsp->queue->dev->inline_data_size) { + if (off || len > rsp->queue->dev->inline_data_size) { pr_err("invalid inline data offset!\n"); return NVME_SC_SGL_INVALID_OFFSET | NVME_STATUS_DNR; }