RDMA/srpt: fix integer overflow in immediate data length check

imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().

Use check_add_overflow() to detect wrapping before the comparison.

Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data")
Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com>
Link: https://patch.msgid.link/20260504080036.3482415-1-sarajvenkatesh@gmail.com
Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 9aec5d80117f1f312856326c6e2d8df788053686..f66cfd70c2636a1e571a53b00fcfdbbb263524f5 100644 (file)
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
                struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
                void *data = (void *)srp_cmd + imm_data_offset;
                uint32_t len = be32_to_cpu(imm_buf->len);
-               uint32_t req_size = imm_data_offset + len;
+               uint32_t req_size;
 
-               if (req_size > srp_max_req_size) {
+               if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
+                   req_size > srp_max_req_size) {
                        pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
                               imm_data_offset, len, srp_max_req_size);
                        return -EINVAL;