Re: [PATCH v2] RDMA/mlx5: Fix destination index when resizing a CQ

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] rdma: mlx5: OOB write in copy_resize_cqes() via negative signed modulo
--

commit 0306cc5acf75dd86ce62818b27d260ae4841d2e6
Author: Li RongQing <lirongqing@baidu.com>

RDMA/mlx5: Fix destination index when resizing a CQ

This commit fixes the destination index calculation when resizing a CQ in the
mlx5 driver. It replaces a bitwise AND with a modulo operation to ensure the
destination slot remains within the resized CQ buffer.

> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index 072b77a2c8a6c..928330f8a6dab 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -1313,7 +1313,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq)
>  
>  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
>  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> -					     (i + 1) & cq->resize_buf->nent);
> +					     (i + 1) % cq->resize_buf->nent);
                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: Critical]
Could this result in an out-of-bounds write?

In copy_resize_cqes(), i is an int assigned from the u32 counter
cq->mcq.cons_index. On high-throughput networks, cons_index can exceed
INT_MAX, causing i to become negative.

When i + 1 is negative, the signed modulo operation yields a negative
remainder. This negative value is passed to mlx5_frag_buf_get_wqe(), where it
is implicitly cast to u32 ix:

include/linux/mlx5/driver.h:mlx5_frag_buf_get_wqe() {
    ...
    frag = ix >> fbc->log_frag_strides;

    return fbc->frags[frag].buf + ((fbc->frag_sz_m1 & ix) << fbc->log_stride);
}

This cast results in a massive unsigned value, leading to an out-of-bounds
pointer for dcqe. The subsequent memcpy(dcqe, scqe, dsize) would then
corrupt kernel memory.

>  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
>  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
>  		memcpy(dcqe, scqe, dsize);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930010630.2797-1-lirongqing@baidu.com?part=1