Linux kernel RDMA core (ib_uverbs post_send / post_recv command parsing): The uverbs write path multiplied two fully

Impact

The uverbs write path multiplied two fully user-controlled u32 fields (wqe_size x wr_count) without overflow checking, and fed the wrapped result to the request-buffer walker. A tenant picks the two values so the product wraps, the length check passes, and the kernel then walks past the end of the copied command buffer. Same shape applies to sge_count x sizeof(ib_uverbs_sge). This is the front door of the verbs API - it is what every RDMA application calls to post work - so no unusual capability or device is required beyond the uverbs node the tenant already has.

Who can reach it

Local write() on /dev/infiniband/uverbs*, i.e. any container doing RDMA. Unprivileged.

What to do

Kernel update that reorders the bound check in uverbs_request_next_ptr() so the user-controlled length is compared alone, and converts the callers to size_mul(). No runtime toggle exists - the only alternative is denying uverbs to tenants, which disables RDMA.

References