Jérémy Jean 9ff797e516 RDMA/siw: Bound fragmented header copies by the remaining length ... siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. Fixes: 754209850d ("RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.") Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260908085520.1746329-1-Jeremy.Jean@oss.cyber.gouv.fr Assisted-by: Codex:gpt-6 Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>		2026-09-10 11:15:46 -04:00
..
rdmavt	RDMA: Use ib_no_udata_io() in query_device callbacks	2026-07-20 09:00:40 -04:00
rxe	RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds	2026-09-01 09:12:02 -04:00
siw	RDMA/siw: Bound fragmented header copies by the remaining length	2026-09-10 11:15:46 -04:00
Makefile	rdma/siw: addition to kernel build environment	2019-07-02 17:03:41 -03:00