Re: [PATCH v2] RDMA/srpt: bound the indirect descriptor table and widen the counters

[sashiko-bot@kernel.org]

> srpt_get_desc_tbl() bounds the number of indirect data buffer descriptors
> by the two counts the initiator put in the SRP_CMD, and both are u8, so it
> admits an nbufs of up to 510:
> 
> 	if (nbufs >
> 	    (srp_cmd->data_out_desc_cnt + srp_cmd->data_in_desc_cnt)) {
> 		...
> 		return -EINVAL;
> 	}
> 
> Nothing checks that the header and those nbufs entries are inside the
> information unit that was received.  srpt_alloc_rw_ctxs() walks
> idb->desc_list for nbufs entries ending at
> 
> 	sizeof(struct srp_cmd) + (srp_cmd->add_cdb_len & ~3) +
> [ ... ]
> that fit the IU are accepted with every context freed again.
> 
> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021001854.2343027-1-yhlee@isslab.korea.ac.kr?part=1