Re: [PATCH v2] RDMA/srpt: bound the indirect descriptor table and widen the counters

[Bart Van Assche <bvanassche@acm.org>]

On 10/20/26 5:18 PM, Yehyeong Lee wrote:
>    BUG: KASAN: slab-out-of-bounds in srpt_alloc_rw_ctxs+0x6ee/0x950
>    Read of size 4 at addr 000000006318205c by task kunit_try_catch/33

Some feedback about this patch:
* Since this patch fixes two separate bugs, should it perhaps be split
   into two patches? The fixed issues are:
    - The missing bound on the descriptor table goes back to
      commit a42d985bd5b2. The original code did `memcpy(ioctx->rbufs,
      db, n_rbuf * sizeof *db)` with the same missing check.
    - The `u8` `n_rw_ctx`/`n_rdma` counters came in with commit
      b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE
      API").
* n_rdma can overflow without many descriptors. It is the sum of
   rdma_rw_ctx_init() return values (work requests per context), and that
   can exceed 255 even for a few large descriptors. Widening it fixes
   more than the commit message says; please mention that.
* The `idb` header ends at most at offset 320, and `MIN_MAX_REQ_SIZE` is
   996, so reading it is never out of bounds; at worst it reads stale
   data. The extra check is fine, but both checks could be folded into
   one, placed after the existing descriptor-count check.

Thanks,

Bart.