Jérémy Jean 9ff797e516 RDMA/siw: Bound fragmented header copies by the remaining length ...

siw_get_hdr() can receive an extended DDP/RDMAP header across more than
one TCP callback. The first callback may receive most of the header,
while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead
of the number of missing bytes. This makes the destination move past the
end of the header and overwrite the receive state, including
fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd
value as a copy offset, which creates an OOB write.

Use the number of header bytes already received when calculating the
next copy length.

Fixes: 754209850d ("RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.")
Signed-off-by: Jérémy Jean <[email protected]>
Link: https://patch.msgid.link/[email protected]
Assisted-by: Codex:gpt-6
Acked-by: Bernard Metzler <[email protected]>
Signed-off-by: Leon Romanovsky <[email protected]>

2026-09-10 11:15:46 -04:00

..

rdmavt

RDMA: Use ib_no_udata_io() in query_device callbacks

2026-07-20 09:00:40 -04:00

rxe

RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

2026-09-01 09:12:02 -04:00

siw

RDMA/siw: Bound fragmented header copies by the remaining length

2026-09-10 11:15:46 -04:00

Makefile

…