diff options
| author | YunJe Shin <yjshin0438@gmail.com> | 2026-02-03 19:06:21 +0900 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-02-05 07:25:38 -0500 |
| commit | 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 (patch) | |
| tree | 58adb8653cacb45433d2c5f8e23a3c6e1cc03d75 /tools/lib/python | |
| parent | 42e3aac65c1c9eb36cdee0d8312a326196e0822f (diff) | |
RDMA/umad: Reject negative data_len in ib_umad_write
ib_umad_write computes data_len from user-controlled count and the
MAD header sizes. With a mismatched user MAD header size and RMPP
header length, data_len can become negative and reach ib_create_send_mad().
This can make the padding calculation exceed the segment size and trigger
an out-of-bounds memset in alloc_send_rmpp_list().
Add an explicit check to reject negative data_len before creating the
send buffer.
KASAN splat:
[ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
[ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
[ 211.365867] ib_create_send_mad+0xa01/0x11b0
[ 211.365887] ib_umad_write+0x853/0x1c80
Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support")
Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions