Re: [PATCH rdma-next 1/2] RDMA/mlx5: Fix DEVX UMEM mailbox size truncation

[Edward Srouji <edwards@nvidia.com>]

On 11/9/2026 4:52 PM, sashiko-bot@kernel.org wrote:
> External email: Use caution opening links or attachments
> 
> 
> Thank you for your contribution! Sashiko AI review found no new issues
> in this patch, but noticed 1 related pre-existing issue it does not
> introduce:
> - [Medium] RDMA/mlx5: devx_umem_find_best_pgsize() ignores pgsz_bitmap
>    after halving page_size [1]
> --
> 
> commit bd5b83068caa4612b47dcf836a1a42f89cbb5cc5
> Author: Uri Dar <udar@nvidia.com>
> 
> RDMA/mlx5: Fix DEVX UMEM mailbox size truncation
> 
> This commit changes cmd->inlen in struct devx_umem_reg_cmd to int and adds
> overflow checks when computing the CREATE_UMEM mailbox size in
> devx_umem_reg_cmd_alloc().
> 
>> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
>> index fc6f793dcc658..1da6c0e440d6e 100644
>> --- a/drivers/infiniband/hw/mlx5/devx.c
>> +++ b/drivers/infiniband/hw/mlx5/devx.c
> 
> [ ... ]
> 
>> @@ -2361,9 +2362,12 @@ static int devx_umem_reg_cmd_alloc(struct mlx5_ib_dev *dev,
>>        if (!page_size)
>>                return -EINVAL;
>>
>> -     cmd->inlen = MLX5_ST_SZ_BYTES(create_umem_in) +
>> -                  (MLX5_ST_SZ_BYTES(mtt) *
>> -                   ib_umem_num_dma_blocks(obj->umem, page_size));
>> +     num_mtt = ib_umem_num_dma_blocks(obj->umem, page_size);
>> +     if (check_add_overflow(MLX5_ST_SZ_BYTES(create_umem_in),
>> +                            size_mul(MLX5_ST_SZ_BYTES(mtt), num_mtt),
>> +                            &cmd->inlen))
>> +             return -EINVAL;
> 
> [Severity: Medium]
> This problem wasn't introduced by this patch, but can
> devx_umem_find_best_pgsize() return a page_size that is not set in
> pgsz_bitmap [1]?
> 
> drivers/infiniband/hw/mlx5/devx.c:devx_umem_find_best_pgsize() {
>          ...
>          page_size = ib_umem_find_best_pgoff(umem, pgsz_bitmap, U64_MAX);
>          if (!page_size)
>                  return 0;
>          ...
>          while ((ib_umem_dma_offset(umem, page_size) != 0 ||
>                  (umem->length % page_size) != 0) &&
>                  page_size > PAGE_SIZE)
>                  page_size /= 2;
> 
>          return page_size;
> }
> 
> When a physically contiguous umem is registered with a restricted
> MLX5_IB_ATTR_DEVX_UMEM_REG_PGSZ_BITMAP, ib_umem_find_best_pgoff() selects
> the largest matching bit regardless of DMA offset or total length, and the
> loop then halves page_size without checking that the reduced size is still
> present in pgsz_bitmap.  devx_umem_reg_cmd_alloc() then registers the umem
> with a page size that userspace excluded instead of returning -EINVAL.
> 
> [1] https://sashiko.dev/#/bug/linux-6cd20db6-58c6-4b3d-8dd9-c9ee893d4041
> 

Sashiko is correct. Since it's a small local fix, I'll patch it in V2.

> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20261109-devx-umem-mailbox-overflow-v1-0-4a63baab25dc@nvidia.com?part=1