Re: [PATCH v2] RDMA/umad: Reject negative data_len in ib_umad_write

[Leon Romanovsky <leon@kernel.org>]

On Sun, Feb 08, 2026 at 03:00:41PM +0900, yunje shin wrote:
> I noticed I missed the Cc: stable tag. Should this fix be backported
> to stable trees as well?

1. We (the RDMA maintainers) almost always remove stable@ tags from
   submitted patches. We prefer to reserve those tags for cases that
   truly warrant them, where we can take the extra step of preparing a
   proper backport.

2. Patches that include a Fixes line are automatically considered for
   stable@ inclusion by the AUTOSEL tool used by the stable maintainers.

Thanks

> 
> Thanks, YunJe Shin
> 
> On Thu, Feb 5, 2026 at 9:53 PM Leon Romanovsky <leon@kernel.org> wrote:
> >
> >
> > On Tue, 03 Feb 2026 19:06:21 +0900, YunJe Shin wrote:
> > > ib_umad_write computes data_len from user-controlled count and the
> > > MAD header sizes. With a mismatched user MAD header size and RMPP
> > > header length, data_len can become negative and reach ib_create_send_mad().
> > > This can make the padding calculation exceed the segment size and trigger
> > > an out-of-bounds memset in alloc_send_rmpp_list().
> > >
> > > Add an explicit check to reject negative data_len before creating the
> > > send buffer.
> > >
> > > [...]
> >
> > Applied, thanks!
> >
> > [1/1] RDMA/umad: Reject negative data_len in ib_umad_write
> >       https://git.kernel.org/rdma/rdma/c/5551b02fdbfd85
> >
> > Best regards,
> > --
> > Leon Romanovsky <leon@kernel.org>
> >
>