Re: [PATCH v2 0/2] IB/isert: bound declared PDU lengths by what was received

[Leon Romanovsky]

On Mon, 27 Jul 2026 01:39:29 +0900, Yehyeong Lee wrote:
> v1 added a wc->byte_len check to isert_recv_done() only.  Leon Romanovsky
> pointed out that the login path needs the same treatment, and he was
> right: the declared DataSegmentLength of a login PDU is never compared
> against what arrived either, and the login code reads it back out of a
> fixed 8192-byte buffer before authentication - from two different
> callers, depending on which login PDU it is.  I reproduced both under
> KASAN before writing 2/2; the splats are in its changelog.
> 
> [...]

Applied, thanks!

[1/2] IB/isert: reject PDUs declaring more data than was received
      https://git.kernel.org/rdma/rdma/c/957f92ea4022fb
[2/2] IB/isert: reject login PDUs declaring more data than was received
      https://git.kernel.org/rdma/rdma/c/2488b5b4827e54

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>