Re: [PATCH] RDMA/srpt: fix integer overflow in immediate data length check

[Sara Venkatesh]

Hi Bart,

Yes, tested with blktests srp suite against this patch on 7.1.0-rc2:

srp/001 ... [passed]
srp/002 ... [passed]
srp/005 ... [passed]
srp/006 ... [passed]
srp/007 ... [passed]
srp/008 ... [passed]
srp/009 ... [passed]
srp/010 ... [passed]
srp/011 ... [passed]
srp/012 ... [passed]
srp/013 ... [passed]
srp/014 ... [passed]
srp/016 ... [passed]

srp/003 and srp/004 are [not run] (legacy device mapper support missing).

Thanks,
Sara

On 5/4/26 01:17, Bart Van Assche wrote:
> On 5/4/26 10:00 AM, Sara Venkatesh wrote:
> > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c 
> > b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > index 9aec5d80117f..f66cfd70c263 100644
> > --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > @@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct 
> > srpt_recv_ioctx *recv_ioctx,
> >           struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
> >           void *data = (void *)srp_cmd + imm_data_offset;
> >           uint32_t len = be32_to_cpu(imm_buf->len);
> > -        uint32_t req_size = imm_data_offset + len;
> > +        uint32_t req_size;
> >   -        if (req_size > srp_max_req_size) {
> > +        if (check_add_overflow((uint32_t)imm_data_offset, len, 
> > &req_size) ||
> > +            req_size > srp_max_req_size) {
> >               pr_err("Immediate data (length %d + %d) exceeds request 
> > size %d\n",
> >                      imm_data_offset, len, srp_max_req_size);
> >               return -EINVAL;
>
> Do the srp tests from https://github.com/linux-blktests/blktests/ still
> pass with this patch applied?
>
> Thanks,
>
> Bart.