)]}'
{
  "commit": "665294c5a0dfde1b5e8018a065346a1e23bc6ec7",
  "tree": "7c8294c6e718c121556e5c26fc85bddb4da03979",
  "parents": [
    "6c11a2639dfb63c4e76462722172bb48ef33bb0f"
  ],
  "author": {
    "name": "Yi Liu",
    "email": "liuy22@mails.tsinghua.edu.cn",
    "time": "Wed Jun 03 23:57:53 2026 +0800"
  },
  "committer": {
    "name": "Yi Liu",
    "email": "liuy22@mails.tsinghua.edu.cn",
    "time": "Sun Jun 07 22:08:00 2026 +0800"
  },
  "message": "providers/rxe: Avoid 32-bit overflow when validating inline send length\n\npost_one_send() accumulates the total length of all SGEs of a send work\nrequest into an \"unsigned int\" before passing it to validate_send_wr(),\nwhich rejects inline work requests whose length exceeds sq-\u003emax_inline.\n\nBecause each ibv_sge.length is a 32-bit value and the number of SGEs is\nonly bounded by sq-\u003emax_sge, the sum can wrap around 2^32. A caller\nposting an IBV_SEND_INLINE work request with several SGEs whose real\ntotal exceeds 4 GiB but whose truncated 32-bit sum is \u003c\u003d max_inline\npasses the check. init_send_wqe() then copies each SGE into\nwqe-\u003edma.inline_data using its real length, writing past the inline area\nof the WQE in the mapped send queue and corrupting adjacent WQEs.\n\nAccumulate the length in a 64-bit variable and validate the untruncated\nvalue. Once validate_send_wr() accepts an inline request its length is\n\u003c\u003d max_inline, so the subsequent narrowing to the 32-bit dma.length\nfield is safe.\n\nFixes: 311e6f0b4 (\"Initial version librxe-1.0.0\")\nSigned-off-by: Yi Liu \u003cliuy22@mails.tsinghua.edu.cn\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "423f834b1a73e3b9b60565511e965422a93204a0",
      "old_mode": 33188,
      "old_path": "providers/rxe/rxe.c",
      "new_id": "df88824dc89161f172a295ffc06ef10ed07951cb",
      "new_mode": 33188,
      "new_path": "providers/rxe/rxe.c"
    }
  ]
}