[bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs

[Dan Carpenter <error27@gmail.com>]

Hello Yishai Hadas,

Commit d83edab562a4 ("RDMA/core: Introduce a DMAH object and its
alloc/free APIs") from Jul 17, 2025 (linux-next), leads to the
following Smatch static checker warning:

	drivers/infiniband/core/uverbs_std_types_dmah.c:50 ib_uverbs_handler_UVERBS_METHOD_DMAH_ALLOC()
	error: passing untrusted data 'dmah->cpu_id' to 'cpumask_test_cpu()'

drivers/infiniband/core/uverbs_std_types_dmah.c
    40         dmah = rdma_zalloc_drv_obj(ib_dev, ib_dmah);
    41         if (!dmah)
    42                 return -ENOMEM;
    43 
    44         if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_CPU_ID)) {
    45                 ret = uverbs_copy_from(&dmah->cpu_id, attrs,
                                              ^^^^^^^^^^^^^
cpu_id is untrusted data.

    46                                        UVERBS_ATTR_ALLOC_DMAH_CPU_ID);
    47                 if (ret)
    48                         goto err;
    49 
--> 50                 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
                                             ^^^^^^^^^^^^
You can't pass untrusted data to cpumask_test_cpu() or it results in
possibly a WARN_ON() (most people have reboot on WARN enabled) and
and out of bounds access.

    51                         ret = -EPERM;
    52                         goto err;
    53                 }
    54 
    55                 dmah->valid_fields |= BIT(IB_DMAH_CPU_ID_EXISTS);
    56         }
    57 
    58         if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE)) {
    59                 dmah->mem_type = uverbs_attr_get_enum_id(attrs,
    60                                         UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE);

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter