mirror of
https://github.com/torvalds/linux.git
synced 2026-10-16 12:50:02 +02:00
9ff797e516
siw_get_hdr() can receive an extended DDP/RDMAP header across more than
one TCP callback. The first callback may receive most of the header,
while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead
of the number of missing bytes. This makes the destination move past the
end of the header and overwrite the receive state, including
fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd
value as a copy offset, which creates an OOB write.
Use the number of header bytes already received when calculating the
next copy length.
Fixes:
|
||
|---|---|---|
| .. | ||
| iwarp.h | ||
| Kconfig | ||
| Makefile | ||
| siw_cm.c | ||
| siw_cm.h | ||
| siw_cq.c | ||
| siw_main.c | ||
| siw_mem.c | ||
| siw_mem.h | ||
| siw_qp_rx.c | ||
| siw_qp_tx.c | ||
| siw_qp.c | ||
| siw_verbs.c | ||
| siw_verbs.h | ||
| siw.h | ||