Re: [PATCH 5.15.y] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

[sashiko-bot@kernel.org]

> From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
> 
> commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf upstream.
> 
> When receiving proposal msg in server, the fields v2_ext_offset/
> eid_cnt/ism_gid_cnt in proposal msg are from the remote client
> and can not be fully trusted. Especially the field v2_ext_offset,
> once exceed the max value, there has the chance to access wrong
> address, and crash may happen.
> 
> This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt
> before using them.
> 
> Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
> Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
> Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
> Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [ jcao: drop the af_smc.c hunk, smc_find_rdma_v2_device_serv() came
>   with SMC-Rv2 in e49300a6bf62 (v5.16); take SMC_CLC_MAX_UEID from
>   fa0866625543 (v5.16); SMC_MAX_ISM_DEVS is the pre-b40584d14570 name
>   of SMCD_CLC_MAX_V2_GID_ENTRIES ]
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920051336.712097-1-junjie.cao@intel.com?part=1