linuxmsm/laptops-kernel
0
0
Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

misc: ibmvmc: reject oversized inbound messages

Browse Source 
ibmvmc_recv_msg() trusts the message length from the CRQ.

It passes that length directly to h_copy_rdma().

The destination buffer is only max_mtu bytes.

A larger length can overrun it before userspace reads the message.

Validate the CRQ length before issuing the RDMA copy.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624175139.7981-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yousef Alhouseen
2026-07-17 15:50:03 +02:00
committed by Greg Kroah-Hartman
parent fd62c1f591
commit 18189e5d84
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/misc/ibmvmc.c
+7
View File
@@ -1659,6 +1659,13 @@ static int ibmvmc_recv_msg(struct crq_server_adapter *adapter,
return -1;
}
if (msg_len > buffer->size) {
dev_err(adapter->dev, "Recv_msg: msg_len 0x%lx exceeds buffer size 0x%x\n",
msg_len, buffer->size);
spin_unlock_irqrestore(&hmc->lock, flags);
return -1;
}
/* RDMA the data into the partition. */
rc = h_copy_rdma(msg_len,
adapter->riobn,