Re: [PATCH] RDMA/umad: Reject negative data_len in ib_umad_write

[Jason Gunthorpe <jgg@ziepe.ca>]

On Sat, Jan 31, 2026 at 11:09:14PM +0900, YunJe Shin wrote:
> ib_umad_write computes data_len from user-controlled count and the
> MAD header sizes. With a mismatched user MAD header size and RMPP
> header length, data_len can become negative and reach ib_create_send_mad().
> This can make the padding calculation exceed the segment size and trigger
> an out-of-bounds memset in alloc_send_rmpp_list().
> 
> Add an explicit check to reject negative data_len before creating the
> send buffer.
> 
> KASAN splat:
> [  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
> [  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
> [  211.365867] ib_create_send_mad+0xa01/0x11b0
> [  211.365887] ib_umad_write+0x853/0x1c80
> 
> Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support")
> Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
> ---
>  drivers/infiniband/core/user_mad.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
> index fd67fc9fe85a..db1643aab029 100644
> --- a/drivers/infiniband/core/user_mad.c
> +++ b/drivers/infiniband/core/user_mad.c
> @@ -588,7 +588,15 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
>  	}
>  
>  	base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version;
> +	if (count < hdr_size(file) + hdr_len) {
> +		ret = -EINVAL;
> +		goto err_ah;
> +	}
>  	data_len = count - hdr_size(file) - hdr_len;
> +	if (data_len < 0) {
> +		ret = -EINVAL;
> +		goto err_ah;
> +	}

data_len should also be a size_t to prevent truncation of count.

But I think I would prefer to replace both of these 'ifs' with a
simple check_sub_overflow() after making data_len unsigned.

Jason