lkml.org 
[lkml]   [2026]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check
From
On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> index 9aec5d80117f..f66cfd70c263 100644
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
> struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
> void *data = (void *)srp_cmd + imm_data_offset;
> uint32_t len = be32_to_cpu(imm_buf->len);
> - uint32_t req_size = imm_data_offset + len;
> + uint32_t req_size;
>
> - if (req_size > srp_max_req_size) {
> + if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
> + req_size > srp_max_req_size) {
> pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
> imm_data_offset, len, srp_max_req_size);
> return -EINVAL;

Do the srp tests from https://github.com/linux-blktests/blktests/ still
pass with this patch applied?

Thanks,

Bart.

\
 
 \ /
  Last update: 2026-05-04 10:21    [W:0.063 / U:1.820 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog