Dust Li 78237e3c07 dibs: loopback: validate offset and size in move_data() ...

The loopback move_data() performs a memcpy into the registered DMB
without checking whether offset + size exceeds the DMB length.  Unlike
real ISM hardware, which enforces memory region bounds natively, the
software loopback has no such protection.

A peer-supplied out-of-bounds offset or oversized write would result in
an OOB write past the allocated kernel buffer.  Add an explicit bounds
check before the memcpy to reject such requests with -EINVAL.

Fixes: f7a22071db ("net/smc: implement DMB-related operations of loopback-ism")
Cc: [email protected]
Reported-by: Federico Kirschbaum <[email protected]>
Signed-off-by: Dust Li <[email protected]>
Reported-by: Baul Lee <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>

2026-07-09 12:44:00 +02:00

..

dibs_loopback.c

dibs: loopback: validate offset and size in move_data()

2026-07-09 12:44:00 +02:00

dibs_loopback.h

…

dibs_main.c

dibs: change dibs_class to a const struct

2026-03-04 18:48:15 -08:00

Kconfig

dibs: Improve DIBS prompts and help texts

2026-05-18 16:53:53 -07:00

Makefile

…