diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-24 19:51:39 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-17 15:50:03 +0200 |
| commit | 18189e5d84aa0b3bc89189cba13b9105634cb6fb (patch) | |
| tree | e3ac5c3550108a7b3f925713e93ada97c649cf27 /tools/perf/scripts/python | |
| parent | fd62c1f591372f7dc4c5bc041569c2f0a4a86be1 (diff) | |
misc: ibmvmc: reject oversized inbound messages
ibmvmc_recv_msg() trusts the message length from the CRQ.
It passes that length directly to h_copy_rdma().
The destination buffer is only max_mtu bytes.
A larger length can overrun it before userspace reads the message.
Validate the CRQ length before issuing the RDMA copy.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624175139.7981-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions