)]}'
{
  "commit": "78237e3c0720fcc6eb9b87e90fd70f63eeca886f",
  "tree": "626153581998515ed11af65563ec77f9bbc52837",
  "parents": [
    "fabb881df322da25442f98d23f5fa371e3c78ec4"
  ],
  "author": {
    "name": "Dust Li",
    "email": "dust.li@linux.alibaba.com",
    "time": "Tue Jul 07 15:43:18 2026 +0800"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Thu Jul 09 12:44:00 2026 +0200"
  },
  "message": "dibs: loopback: validate offset and size in move_data()\n\nThe loopback move_data() performs a memcpy into the registered DMB\nwithout checking whether offset + size exceeds the DMB length.  Unlike\nreal ISM hardware, which enforces memory region bounds natively, the\nsoftware loopback has no such protection.\n\nA peer-supplied out-of-bounds offset or oversized write would result in\nan OOB write past the allocated kernel buffer.  Add an explicit bounds\ncheck before the memcpy to reject such requests with -EINVAL.\n\nFixes: f7a22071dbf3 (\"net/smc: implement DMB-related operations of loopback-ism\")\nCc: stable@vger.kernel.org\nReported-by: Federico Kirschbaum \u003cfederico.kirschbaum@xbow.com\u003e\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nReported-by: Baul Lee \u003cbaul.lee@xbow.com\u003e\nLink: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ec3b48cb0e8742ed07f190ab7a09591d358e0ab1",
      "old_mode": 33188,
      "old_path": "drivers/dibs/dibs_loopback.c",
      "new_id": "0f2e093111526b0f9bbb4e767e49e1202f320a54",
      "new_mode": 33188,
      "new_path": "drivers/dibs/dibs_loopback.c"
    }
  ]
}