Re: [PATCH] RDMA/siw: Bound fragmented header copies by the remaining length

[Leon Romanovsky]

On Tue, 08 Sep 2026 08:55:20 +0000, Jérémy Jean wrote:
> siw_get_hdr() can receive an extended DDP/RDMAP header across more than
> one TCP callback. The first callback may receive most of the header,
> while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead
> of the number of missing bytes. This makes the destination move past the
> end of the header and overwrite the receive state, including
> fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd
> value as a copy offset, which creates an OOB write.
> 
> [...]

Applied, thanks!

[1/1] RDMA/siw: Bound fragmented header copies by the remaining length
      https://git.kernel.org/rdma/rdma/c/9ff797e516dbc1

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>