Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range): The inline copy path adds a page index where it

Impact

The inline copy path adds a page index where it should add a byte offset, so memcpy lands outside the current page and writes into unrelated kernel memory on the NFS server. Triggered by ordinary RDMA inline traffic from a client.

Who can reach it

Any NFS/RDMA client that can reach the storage server over the fabric.

What to do

Update the storage server kernel to one carrying the rc_pageoff fix and reboot. Serve affected exports over TCP as a stopgap.

References