Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range): svc_rdma_copy_inline_range indexes rq_pages with an

Impact

svc_rdma_copy_inline_range indexes rq_pages with an unvalidated rc_curpage, so a crafted inline RDMA message walks the server past the end of its page array. Kernel memory corruption on the storage server, triggered from the RDMA fabric.

Who can reach it

Any NFS/RDMA client on the same fabric as the storage server.

What to do

Update the storage server kernel and reboot. Interim mitigation is to serve the affected exports over TCP instead of RDMA.

References