Dust Li 78237e3c07 dibs: loopback: validate offset and size in move_data() ... The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection. A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL. Fixes: f7a22071db ("net/smc: implement DMB-related operations of loopback-ism") Cc: stable@vger.kernel.org Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com> Signed-off-by: Dust Li <dust.li@linux.alibaba.com> Reported-by: Baul Lee <baul.lee@xbow.com> Link: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2026-07-09 12:44:00 +02:00
..
dibs_loopback.c	dibs: loopback: validate offset and size in move_data()	2026-07-09 12:44:00 +02:00
dibs_loopback.h
dibs_main.c	dibs: change dibs_class to a const struct	2026-03-04 18:48:15 -08:00
Kconfig	dibs: Improve DIBS prompts and help texts	2026-05-18 16:53:53 -07:00
Makefile