Messages in this thread |  | | From | Leon Romanovsky <> | | Subject | Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check | | Date | Tue, 12 May 2026 06:41:28 -0400 |
| |
On Mon, 04 May 2026 01:00:36 -0700, Sara Venkatesh wrote: > imm_buf->len is a user-controlled uint32_t received from the network. > Adding it to imm_data_offset without overflow checking allows a > malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap > around to a small value, bypassing the bounds check, and subsequently > passing a ~4GB length to sg_init_one(). > > Use check_add_overflow() to detect wrapping before the comparison. > > [...]
Applied, thanks!
[1/1] RDMA/srpt: fix integer overflow in immediate data length check https://git.kernel.org/rdma/rdma/c/3f716b34c639f6
Best regards, -- Leon Romanovsky <leon@kernel.org>
|  |