Re: [PATCH for-rc v2 2/8] RDMA/bnxt_re: Detect wrong sge_len passed for inline

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in `bnxt_re_build_sgl` leads to improper rejection of valid large RDMA payloads.
--

commit ce7a03605a13da6e57de1f53a8c0119ccee546dd
Author: Selvin Xavier <selvin.xavier@broadcom.com>

RDMA/bnxt_re: Detect wrong sge_len passed for inline

This commit avoids handling wrong sge_len by adding an extra check to see if
the passed length is more than the inline size supported.

> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index d80a22e4ac70d..e56830a669bf4 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -3168,8 +3168,9 @@ static int bnxt_re_copy_inline_data(struct bnxt_re_dev *rdev,
>  				wr->sg_list[i].addr;
>  		sge_len = wr->sg_list[i].length;
>  
> -		if ((sge_len + wqe->inline_len) >
> -		    BNXT_QPLIB_SWQE_MAX_INLINE_LENGTH) {
> +		if (sge_len > BNXT_QPLIB_SWQE_MAX_INLINE_LENGTH ||
> +		    ((sge_len + wqe->inline_len) >
> +		    BNXT_QPLIB_SWQE_MAX_INLINE_LENGTH)) {
>  			ibdev_err(&rdev->ibdev,
>  				  "Inline data size requested > supported value");
>  			return -EINVAL;

[Severity: High]
This is a pre-existing issue, but it exists in the directly associated code
paths. Does bnxt_re_build_sgl() have an integer overflow when dealing with
large RDMA payloads?

drivers/infiniband/hw/bnxt_re/ib_verbs.c:bnxt_re_build_sgl() {
        int i, total = 0;

        for (i = 0; i < num; i++) {
                ...
                total += sg_list[i].size;
        }
        return total;
}

Since total is declared as a signed 32-bit integer, could summing unsigned
32-bit size values from multiple SGEs cause it to overflow and become
negative for payloads greater than 2GB?

If this overflows and becomes negative, it appears the negative total is
propagated here:

drivers/infiniband/hw/bnxt_re/ib_verbs.c:bnxt_re_post_send() {
        ...
        payload_sz = bnxt_re_copy_wr_payload(qp->rdev, wr, &wqe);
        if (payload_sz < 0) {
                rc = -EINVAL;
                goto bad;
        }
}

Would this cause legitimate RDMA send or write operations with payloads
between 2GB and 4GB to be erroneously rejected, breaking core functionality
for user-space applications performing large I/O?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909135244.122747-1-selvin.xavier@broadcom.com?part=2