Re: [PATCH] RDMA/siw: Bound fragmented header copies by the remaining length

[Bernard Metzler]

On 08.09.2026 10:55, Jérémy Jean wrote:
> siw_get_hdr() can receive an extended DDP/RDMAP header across more than
> one TCP callback. The first callback may receive most of the header,
> while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead
> of the number of missing bytes. This makes the destination move past the
> end of the header and overwrite the receive state, including
> fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd
> value as a copy offset, which creates an OOB write.

Excellent finding, thank you! That must trickle down to older stable.

> Use the number of header bytes already received when calculating the
> next copy length.
>
> Fixes: 754209850df8 ("RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.")
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> Assisted-by: Codex:gpt-6
> ---
>   drivers/infiniband/sw/siw/siw_qp_rx.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
> index b566d16..e5b641c 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_rx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
> @@ -1079,7 +1079,7 @@ static int siw_get_hdr(struct siw_rx_stream *srx)
>   	if (iwarp_pktinfo[opcode].hdr_len > sizeof(struct iwarp_ctrl_tagged)) {
>   		int hdrlen = iwarp_pktinfo[opcode].hdr_len;
>   
> -		bytes = min_t(int, hdrlen - MIN_DDP_HDR, srx->skb_new);
> +		bytes = min_t(int, hdrlen - srx->fpdu_part_rcvd, srx->skb_new);
>   
>   		skb_copy_bits(skb, srx->skb_offset,
>   			      (char *)c_hdr + srx->fpdu_part_rcvd, bytes);

Acked-by: Bernard Metzler <bernard.metzler@xxxxxxxxx>