Sara Venkatesh eb4ecdf631 RDMA/srpt: fix integer overflow in immediate data length check ... imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison. Fixes: 5dabcd0456 ("RDMA/srpt: Add support for immediate data") Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org> Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com> Link: https://patch.msgid.link/20260504080036.3482415-1-sarajvenkatesh@gmail.com Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Leon Romanovsky <leon@kernel.org>		2026-05-18 04:58:41 -04:00
..
ib_dm_mad.h	ib_srpt: Initial SRP Target merge for v3.3-rc1	2011-12-16 06:33:56 +00:00
ib_srpt.c	RDMA/srpt: fix integer overflow in immediate data length check	2026-05-18 04:58:41 -04:00
ib_srpt.h	RDMA/srpt: Fix a use-after-free	2022-07-29 16:45:37 -03:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00