[PATCH v2 0/2] IB/isert: bound declared PDU lengths by what was received

[Yehyeong Lee]

v1 added a wc->byte_len check to isert_recv_done() only.  Leon Romanovsky
pointed out that the login path needs the same treatment, and he was
right: the declared DataSegmentLength of a login PDU is never compared
against what arrived either, and the login code reads it back out of a
fixed 8192-byte buffer before authentication - from two different
callers, depending on which login PDU it is.  I reproduced both under
KASAN before writing 2/2; the splats are in its changelog.

1/2 is v1 unchanged apart from one sentence in the changelog, which said
the login handler already had a length check.  It has one, but not this
one - 29e7b925ae6d bounds login_req_len from below, and nothing bounded
the declared length from above.

v1: https://lore.kernel.org/linux-rdma/20260725011846.538191-1-yhlee@xxxxxxxxxxxxxxxxxx/

Yehyeong Lee (2):
  IB/isert: reject PDUs declaring more data than was received
  IB/isert: reject login PDUs declaring more data than was received

 drivers/infiniband/ulp/isert/ib_isert.c | 40 ++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

-- 
2.43.0