Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Sara Venkatesh <sarajvenkatesh@gmail.com>]

Hi Bart,

Yes, tested with blktests srp suite against this patch on 7.1.0-rc2:

srp/001 ... [passed]
srp/002 ... [passed]
srp/005 ... [passed]
srp/006 ... [passed]
srp/007 ... [passed]
srp/008 ... [passed]
srp/009 ... [passed]
srp/010 ... [passed]
srp/011 ... [passed]
srp/012 ... [passed]
srp/013 ... [passed]
srp/014 ... [passed]
srp/016 ... [passed]

srp/003 and srp/004 are [not run] (legacy device mapper support missing).

Thanks,
Sara

On 5/4/26 01:17, Bart Van Assche wrote:
> On 5/4/26 10:00 AM, Sara Venkatesh wrote:
>> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c 
>> b/drivers/infiniband/ulp/srpt/ib_srpt.c
>> index 9aec5d80117f..f66cfd70c263 100644
>> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
>> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
>> @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct 
>> srpt_recv_ioctx *recv_ioctx,
>>           struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
>>           void *data = (void *)srp_cmd + imm_data_offset;
>>           uint32_t len = be32_to_cpu(imm_buf->len);
>> -        uint32_t req_size = imm_data_offset + len;
>> +        uint32_t req_size;
>>   -        if (req_size > srp_max_req_size) {
>> +        if (check_add_overflow((uint32_t)imm_data_offset, len, 
>> &req_size) ||
>> +            req_size > srp_max_req_size) {
>>               pr_err("Immediate data (length %d + %d) exceeds request 
>> size %d\n",
>>                      imm_data_offset, len, srp_max_req_size);
>>               return -EINVAL;
>
> Do the srp tests from https://github.com/linux-blktests/blktests/ still
> pass with this patch applied?
>
> Thanks,
>
> Bart.