Re: [PATCH v2] vfio/mlx5: Fix boundary check in set_report_output()

[Alex Williamson <alex@shazbot.org>]

On Mon, 05 Oct 2026 16:16:29 +0000
Seongjun Hong <hsj0512@snu.ac.kr> wrote:

> Use > instead of >= on boundary check of recv_buf to avoid the bug which
> the full message in the last slot of recv_buf is ignored even though the
> received data size does not overflow the recv_buf.
> 
> Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
> Cc: stable@vger.kernel.org
> Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
> Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
> ---
> Changes in v2:
> - Drop the max_msg_size readability change. Keep only the fix.
> - Add Cc: stable@vger.kernel.org.
> - Link to v1: https://lore.kernel.org/r/20261004-vfio-mlx5-fix-boundary-check-v1-1-1d3b8e55e23f@snu.ac.kr
> ---
>  drivers/vfio/pci/mlx5/cmd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
> index 5fe0621b5fbd..04180035a7fe 100644
> --- a/drivers/vfio/pci/mlx5/cmd.c
> +++ b/drivers/vfio/pci/mlx5/cmd.c
> @@ -1644,7 +1644,7 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
>  	int i;
>  
>  	buf_offset = index * qp->max_msg_size;
> -	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
> +	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
>  		    (nent > qp->max_msg_size / entry_size)))
>  		return;
>  
> 
> ---
> base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
> change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2
> 
> Best regards,

Applied to vfio next branch for v7.4.  Thanks,

Alex