Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Bart Van Assche]

On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> index 9aec5d80117f..f66cfd70c263 100644
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
>   		struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
>   		void *data = (void *)srp_cmd + imm_data_offset;
>   		uint32_t len = be32_to_cpu(imm_buf->len);
> -		uint32_t req_size = imm_data_offset + len;
> +		uint32_t req_size;
>   
> -		if (req_size > srp_max_req_size) {
> +		if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
> +		    req_size > srp_max_req_size) {
>   			pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
>   			       imm_data_offset, len, srp_max_req_size);
>   			return -EINVAL;

Do the srp tests from https://github.com/linux-blktests/blktests/ still
pass with this patch applied?

Thanks,

Bart.