Re: [PATCH] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

[Leon Romanovsky]

On Wed, 29 Jul 2026 18:32:03 +0900, Yehyeong Lee wrote:
> srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes
> nothing to srp_process_cred_req() and srp_process_aer_req(), which read
> fixed-size fields from the receive buffer without checking that those
> fields were received.
> 
> The buffer size is max_ti_iu_len, which comes from the login response
> and is not validated. A target that advertises 8 and then sends an
> 8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the
> end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent
> back, so those bytes reach the target. SRP_AER_REQ behaves the same way
> and also reads req->lun.
> 
> [...]

Applied, thanks!

[1/1] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
      https://git.kernel.org/rdma/rdma/c/961ac0f0c5e414

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>