[PATCH 5.10.y 0/2] net/smc: bound v2 extension offsets and counts in CLC proposal

[Junjie Cao <junjie.cao@intel.com>]

5.10.y backport of the CVE-2024-49568 fix (patch 2), requested in the
6.1.y thread:
https://lore.kernel.org/r/20260918045353.686837-1-junjie.cao@intel.com

5.10.y also lacks 9ab332deb671 (CVE-2024-47408) from the same upstream
series; 5.15.y has it since v5.15.176. It goes first: the ism_gid_cnt
limit in patch 2 bounds the gidchid[] walk only once smcd_v2_ext
itself is inside the receive buffer. The diff is the same as the
5.15.y backport a36364d8d4fab.

Patch 2 has the same diff as the 5.15.y backport posted alongside.

Each commit builds net/smc on v5.10.270, x86_64, CONFIG_SMC=m, W=1
clean. Not runtime-tested.

Guangguan Wang (2):
  net/smc: check smcd_v2_ext_offset when receiving proposal msg
  net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving
    proposal msg

 net/smc/smc_clc.c |  8 +++++++-
 net/smc/smc_clc.h | 17 +++++++++++++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

-- 
2.43.0