Re: [PATCH] RDMA/mlx5: Fix cntrs_max_index overflow when binding flow counters

[sashiko-bot@kernel.org]

> counters_set_description() stores the highest counter index supplied by
> the user plus one in cntrs_max_index. Both are u32, so an index of
> U32_MAX wraps cntrs_max_index to zero, and the entries after it can only
> raise it to their own index plus one.
> 
> mlx5_ib_read_counters() uses cntrs_max_index to check that every bound
> index fits in the output buffer before it runs
> 
> 	read_attr->counters_buff[desc[i].index] += ...
> 
> With the wrapped value the check passes whatever the buffer size is, and
> the entry with index U32_MAX is added to memory almost 32 GiB past the
> start of the buffer.
> 
> Reject an index of U32_MAX in counters_set_description(), so that
> cntrs_max_index is larger than every bound index.
> 
> Fixes: 3b3233fbf02e ("IB/mlx5: Add flow counters binding support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115085025.53203-1-dennylin0707@gmail.com?part=1