Messages in this thread |  | | Date | Mon, 4 May 2026 10:17:13 +0200 | | Subject | Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check | | From | Bart Van Assche <> |
| |
On 5/4/26 10:00 AM, Sara Venkatesh wrote: > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c > index 9aec5d80117f..f66cfd70c263 100644 > --- a/drivers/infiniband/ulp/srpt/ib_srpt.c > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c > @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx, > struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd); > void *data = (void *)srp_cmd + imm_data_offset; > uint32_t len = be32_to_cpu(imm_buf->len); > - uint32_t req_size = imm_data_offset + len; > + uint32_t req_size; > > - if (req_size > srp_max_req_size) { > + if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) || > + req_size > srp_max_req_size) { > pr_err("Immediate data (length %d + %d) exceeds request size %d\n", > imm_data_offset, len, srp_max_req_size); > return -EINVAL;
Do the srp tests from https://github.com/linux-blktests/blktests/ still pass with this patch applied?
Thanks,
Bart.
|  |