Re: [PATCH net] dibs: loopback: validate offset and size in move_data()

[Paolo Abeni <pabeni@redhat.com>]

On 7/7/26 8:31 PM, Andrew Lunn wrote:
> On Tue, Jul 07, 2026 at 10:31:00PM +0800, Dust Li wrote:
>> On 2026-07-07 15:43:18, Dust Li wrote:
>>> The loopback move_data() performs a memcpy into the registered DMB
>>> without checking whether offset + size exceeds the DMB length.  Unlike
>>> real ISM hardware, which enforces memory region bounds natively, the
>>> software loopback has no such protection.
>>>
>>> A peer-supplied out-of-bounds offset or oversized write would result in
>>> an OOB write past the allocated kernel buffer.  Add an explicit bounds
>>> check before the memcpy to reject such requests with -EINVAL.
>>>
>>> Fixes: f7a22071dbf3("net/smc: implement DMB-related operations of loopback-ism")
>>> Cc: stable@vger.kernel.org
>>> Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
>>
>> Reported-by: Baul Lee <baul.lee@xbow.com>
> 
> Could you provide a link to the report?

Since both reporters belong to the same org, I assume they
co-partecipated at the initial report.

Also there is a problem with the fixes tag that I'll address while
applying the patch.

/P