[PATCH] RDMA/mlx5: Fix cntrs_max_index overflow when binding flow counters

[PATCH] RDMA/mlx5: Fix cntrs_max_index overflow when binding flow counters

[Hungyu Lin]

counters_set_description() stores the highest counter index supplied by
the user plus one in cntrs_max_index. Both are u32, so an index of
U32_MAX wraps cntrs_max_index to zero, and the entries after it can only
raise it to their own index plus one.

mlx5_ib_read_counters() uses cntrs_max_index to check that every bound
index fits in the output buffer before it runs

	read_attr->counters_buff[desc[i].index] += ...

With the wrapped value the check passes whatever the buffer size is, and
the entry with index U32_MAX is added to memory almost 32 GiB past the
start of the buffer.

Reject an index of U32_MAX in counters_set_description(), so that
cntrs_max_index is larger than every bound index.

Fixes: 3b3233fbf02e ("IB/mlx5: Add flow counters binding support")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/infiniband/hw/mlx5/counters.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c
index 1c25b825d0bd..742bb10adc57 100644
--- a/drivers/infiniband/hw/mlx5/counters.c
+++ b/drivers/infiniband/hw/mlx5/counters.c
@@ -1038,7 +1038,8 @@ static int counters_set_description(
 	mcounters->ncounters = ncounters;
 	/* each counter entry have both description and index pair */
 	for (i = 0; i < ncounters; i++) {
-		if (desc_data[i].description > IB_COUNTER_BYTES)
+		if (desc_data[i].description > IB_COUNTER_BYTES ||
+		    desc_data[i].index == U32_MAX)
 			return -EINVAL;

 		if (cntrs_max_index <= desc_data[i].index)
--
2.43.0

Re: [PATCH] RDMA/mlx5: Fix cntrs_max_index overflow when binding flow counters

[sashiko-bot]

> counters_set_description() stores the highest counter index supplied by
> the user plus one in cntrs_max_index. Both are u32, so an index of
> U32_MAX wraps cntrs_max_index to zero, and the entries after it can only
> raise it to their own index plus one.
> 
> mlx5_ib_read_counters() uses cntrs_max_index to check that every bound
> index fits in the output buffer before it runs
> 
> 	read_attr->counters_buff[desc[i].index] += ...
> 
> With the wrapped value the check passes whatever the buffer size is, and
> the entry with index U32_MAX is added to memory almost 32 GiB past the
> start of the buffer.
> 
> Reject an index of U32_MAX in counters_set_description(), so that
> cntrs_max_index is larger than every bound index.
> 
> Fixes: 3b3233fbf02e ("IB/mlx5: Add flow counters binding support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115085025.53203-1-dennylin0707@gmail.com?part=1