On 11/7/26 8:17 AM, Chandradhar Kumar wrote:
On Thu, Nov 05, 2026 at 08:08:01AM -0600, Alex Elder wrote:
Here is what I see happening at the beginning of gb_connection_recv():
- If the connection is disabled or offloaded, return immediately
- If the size of the buffer (passed in as the "size" argument) is less than the size of an operation message header, return
- If the 16-bit size embedded in the message header is less than the size of the buffer, return
In other words, after these checks, we know:
sizeof(header) <= buffer size (size) AND buffer size (size) <= size encoded in the header (msg_size)
No, it does not verify this, it verify: size encoded in the header <= size (buffer size)
You're right, I misread this.
We don't read the header unless size tells us the entire message ("buffer size") is at least the size of the header.
And then we ensure the buffer contains the entire message (whose msg_size is decoded from the header).
But if the size encoded in the message header is bogus (and in particular, smaller than the header size) we have a problem.
Therefore (transitive property), this is true:
sizeof(header) <= size encoded in the header (msg_size)
So, the transitive property is not true.
Agreed. Thanks for explaining where I was wrong.
I have sent a patch for this bug which verify the msg_size and header separately, which fixes the out of bounds read. patch link: https://lore.kernel.org/all/20261106094303.55158-1-chandradhar.2003@gmail.co...
-Alex
Hey please review the patch if there is something wrong or there are any other way to fix the bug.
Thanks.
And it's not possible after these checks for this to be true:
header.size < sizeof(struct gb_operation_msg_hdr)or put another way:
msg_size < sizeof(header) cannot holdIt surprises me this would be missed in the AI summary--and I fear I'm mistaken. If I'm missing something or wrong about this, please feel free to say so.
-Alex