lkml.org 
[lkml]   [2026]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check
From
On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> imm_buf->len is a user-controlled uint32_t received from the network.
> Adding it to imm_data_offset without overflow checking allows a
> malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
> around to a small value, bypassing the bounds check, and subsequently
> passing a ~4GB length to sg_init_one().
>
> Use check_add_overflow() to detect wrapping before the comparison.
Reviewed-by: Bart Van Assche <bvanassche@acm.org>

\
 
 \ /
  Last update: 2026-05-05 10:20    [W:0.122 / U:66.903 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog