Commit 1e8bb2e9 authored by Bart Van Assche's avatar Bart Van Assche Committed by Greg Kroah-Hartman

IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()

commit 2a78cb4d upstream.

Avoid triggering an out-of-bounds stack access by changing the type
of 'wr' from ib_send_wr into ib_rdma_wr.

This patch fixes the following KASAN bug report:

BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
Read of size 8 at addr ffff880068197a48 by task kworker/2:1/44

Workqueue: ib_cm cm_work_handler [ib_cm]
Call Trace:
 rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
 srpt_zerolength_write+0xf0/0x180 [ib_srpt]
 srpt_cm_rtu_recv+0x68/0x110 [ib_srpt]
 srpt_rdma_cm_handler+0xbb/0x15b [ib_srpt]
 cma_ib_handler+0x1aa/0x4a0 [rdma_cm]
 cm_process_work+0x30/0x100 [ib_cm]
 cm_work_handler+0xa86/0x351b [ib_cm]

Fixes: aaf45bd8 ("IB/srpt: Detect session shutdown reliably")
Signed-off-by: default avatarBart Van Assche <>
Cc: Christoph Hellwig <>
Signed-off-by: default avatarJason Gunthorpe <>
Signed-off-by: default avatarSudip Mukherjee <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent d02c9c8b
......@@ -787,13 +787,16 @@ static int srpt_post_recv(struct srpt_device *sdev,
static int srpt_zerolength_write(struct srpt_rdma_ch *ch)
struct ib_send_wr wr, *bad_wr;
struct ib_send_wr *bad_wr;
struct ib_rdma_wr wr = {
.wr = {
.opcode = IB_WR_RDMA_WRITE,
.wr_cqe = &ch->zw_cqe,
.send_flags = IB_SEND_SIGNALED,
memset(&wr, 0, sizeof(wr));
wr.opcode = IB_WR_RDMA_WRITE;
wr.wr_cqe = &ch->zw_cqe;
wr.send_flags = IB_SEND_SIGNALED;
return ib_post_send(ch->qp, &wr, &bad_wr);
return ib_post_send(ch->qp, &wr.wr, &bad_wr);
static void srpt_zerolength_write_done(struct ib_cq *cq, struct ib_wc *wc)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment