YunJe Shin 9c80d688f4 RDMA/umad: Reject negative data_len in ib_umad_write ...

commit 5551b02fdb upstream.

ib_umad_write computes data_len from user-controlled count and the
MAD header sizes. With a mismatched user MAD header size and RMPP
header length, data_len can become negative and reach ib_create_send_mad().
This can make the padding calculation exceed the segment size and trigger
an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the
send buffer.

KASAN splat:
[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
[  211.365867] ib_create_send_mad+0xa01/0x11b0
[  211.365887] ib_umad_write+0x853/0x1c80

Fixes: 2be8e3ee8e ("IB/umad: Add P_Key index support")
Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-03-04 07:19:20 -05:00

..

core

RDMA/umad: Reject negative data_len in ib_umad_write

2026-03-04 07:19:20 -05:00

hw

RDMA/mana_ib: Handle net event for pointing to the current netdev

2026-02-06 16:55:51 +01:00

sw

RDMA/siw: Fix potential NULL pointer dereference in header processing

2026-03-04 07:19:20 -05:00

ulp

RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation

2026-01-08 10:14:37 +01:00

Kconfig

…

Makefile

…