lkml.org 
[lkml]   [2026]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check
Date

On Mon, 04 May 2026 01:00:36 -0700, Sara Venkatesh wrote:
> imm_buf->len is a user-controlled uint32_t received from the network.
> Adding it to imm_data_offset without overflow checking allows a
> malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
> around to a small value, bypassing the bounds check, and subsequently
> passing a ~4GB length to sg_init_one().
>
> Use check_add_overflow() to detect wrapping before the comparison.
>
> [...]

Applied, thanks!

[1/1] RDMA/srpt: fix integer overflow in immediate data length check
https://git.kernel.org/rdma/rdma/c/3f716b34c639f6

Best regards,
--
Leon Romanovsky <leon@kernel.org>


\
 
 \ /
  Last update: 2026-05-12 12:42    [W:0.061 / U:32.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog