Re: [PATCH] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, May 12, 2026 at 06:38:52PM +0000, Jacob Moroni wrote:
> The irdma_copy_user_pgaddrs function loops through all of the umem DMA
> blocks to populate the PBLEs and will stop when either the last DMA
> block is reached or palloc->total_cnt is reached. The issue is that
> the logic for checking palloc->total_cnt would only work for non-zero
> values.
> 
> When irdma_setup_pbles is called with lvl==0, it
> calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
> the only way to break out of the loop is to reach the last umem DMA
> block, which means it could end up going beyond the fixed size of 4
> iwmr->pgaddrmem array that is used in the lvl==0 case.
> 
> In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
> separate input (for example, req.cq_pages in the case of a CQ). So,
> we must perform explicit checking to ensure we don't overflow the
> pgaddrmem array if the user provides a umem that consists of more
> blocks than their provided req.cq_pages.
> 
> Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
> Signed-off-by: Jacob Moroni <jmoroni@google.com>
> ---
>  drivers/infiniband/hw/irdma/verbs.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)

Applied to for-next

Can you also address the unrelated bug sashiko found:

https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com

Thanks,
Jason