* [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs
@ 2026-05-21 8:04 Dan Carpenter
2026-05-24 7:22 ` Yishai Hadas
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2026-05-21 8:04 UTC (permalink / raw)
To: Yishai Hadas; +Cc: linux-rdma
Hello Yishai Hadas,
Commit d83edab562a4 ("RDMA/core: Introduce a DMAH object and its
alloc/free APIs") from Jul 17, 2025 (linux-next), leads to the
following Smatch static checker warning:
drivers/infiniband/core/uverbs_std_types_dmah.c:50 ib_uverbs_handler_UVERBS_METHOD_DMAH_ALLOC()
error: passing untrusted data 'dmah->cpu_id' to 'cpumask_test_cpu()'
drivers/infiniband/core/uverbs_std_types_dmah.c
40 dmah = rdma_zalloc_drv_obj(ib_dev, ib_dmah);
41 if (!dmah)
42 return -ENOMEM;
43
44 if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_CPU_ID)) {
45 ret = uverbs_copy_from(&dmah->cpu_id, attrs,
^^^^^^^^^^^^^
cpu_id is untrusted data.
46 UVERBS_ATTR_ALLOC_DMAH_CPU_ID);
47 if (ret)
48 goto err;
49
--> 50 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
^^^^^^^^^^^^
You can't pass untrusted data to cpumask_test_cpu() or it results in
possibly a WARN_ON() (most people have reboot on WARN enabled) and
and out of bounds access.
51 ret = -EPERM;
52 goto err;
53 }
54
55 dmah->valid_fields |= BIT(IB_DMAH_CPU_ID_EXISTS);
56 }
57
58 if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE)) {
59 dmah->mem_type = uverbs_attr_get_enum_id(attrs,
60 UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE);
This email is a free service from the Smatch-CI project [smatch.sf.net].
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs
2026-05-21 8:04 [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs Dan Carpenter
@ 2026-05-24 7:22 ` Yishai Hadas
2026-05-25 6:52 ` Dan Carpenter
0 siblings, 1 reply; 3+ messages in thread
From: Yishai Hadas @ 2026-05-24 7:22 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-rdma
On 21/05/2026 11:04, Dan Carpenter wrote:
> Hello Yishai Hadas,
>
> Commit d83edab562a4 ("RDMA/core: Introduce a DMAH object and its
> alloc/free APIs") from Jul 17, 2025 (linux-next), leads to the
> following Smatch static checker warning:
>
> drivers/infiniband/core/uverbs_std_types_dmah.c:50 ib_uverbs_handler_UVERBS_METHOD_DMAH_ALLOC()
> error: passing untrusted data 'dmah->cpu_id' to 'cpumask_test_cpu()'
>
> drivers/infiniband/core/uverbs_std_types_dmah.c
> 40 dmah = rdma_zalloc_drv_obj(ib_dev, ib_dmah);
> 41 if (!dmah)
> 42 return -ENOMEM;
> 43
> 44 if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_CPU_ID)) {
> 45 ret = uverbs_copy_from(&dmah->cpu_id, attrs,
> ^^^^^^^^^^^^^
> cpu_id is untrusted data.
>
> 46 UVERBS_ATTR_ALLOC_DMAH_CPU_ID);
> 47 if (ret)
> 48 goto err;
> 49
> --> 50 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
> ^^^^^^^^^^^^
> You can't pass untrusted data to cpumask_test_cpu() or it results in
> possibly a WARN_ON() (most people have reboot on WARN enabled) and
> and out of bounds access.
Thanks Dan for your report.
It seems that the below [1] chunk should solve the issue.
Would you like please to send a fixup patch having it ?
[1]
diff --git a/drivers/infiniband/core/uverbs_std_types_dmah.c
b/drivers/infiniband/core/uverbs_std_types_dmah.c
index 453ce656c6f2..97101e093826 100644
--- a/drivers/infiniband/core/uverbs_std_types_dmah.c
+++ b/drivers/infiniband/core/uverbs_std_types_dmah.c
@@ -47,6 +47,11 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DMAH_ALLOC)(
if (ret)
goto err;
+ if (dmah->cpu_id >= nr_cpu_ids) {
+ ret = -EINVAL;
+ goto err;
+ }
+
if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
ret = -EPERM;
goto err;
Yishai
>
> 51 ret = -EPERM;
> 52 goto err;
> 53 }
> 54
> 55 dmah->valid_fields |= BIT(IB_DMAH_CPU_ID_EXISTS);
> 56 }
> 57
> 58 if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE)) {
> 59 dmah->mem_type = uverbs_attr_get_enum_id(attrs,
> 60 UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE);
>
> This email is a free service from the Smatch-CI project [smatch.sf.net].
>
> regards,
> dan carpenter
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs
2026-05-24 7:22 ` Yishai Hadas
@ 2026-05-25 6:52 ` Dan Carpenter
0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-05-25 6:52 UTC (permalink / raw)
To: Yishai Hadas; +Cc: linux-rdma
On Sun, May 24, 2026 at 10:22:55AM +0300, Yishai Hadas wrote:
> On 21/05/2026 11:04, Dan Carpenter wrote:
> > Hello Yishai Hadas,
> >
> > Commit d83edab562a4 ("RDMA/core: Introduce a DMAH object and its
> > alloc/free APIs") from Jul 17, 2025 (linux-next), leads to the
> > following Smatch static checker warning:
> >
> > drivers/infiniband/core/uverbs_std_types_dmah.c:50 ib_uverbs_handler_UVERBS_METHOD_DMAH_ALLOC()
> > error: passing untrusted data 'dmah->cpu_id' to 'cpumask_test_cpu()'
> >
> > drivers/infiniband/core/uverbs_std_types_dmah.c
> > 40 dmah = rdma_zalloc_drv_obj(ib_dev, ib_dmah);
> > 41 if (!dmah)
> > 42 return -ENOMEM;
> > 43
> > 44 if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_CPU_ID)) {
> > 45 ret = uverbs_copy_from(&dmah->cpu_id, attrs,
> > ^^^^^^^^^^^^^
> > cpu_id is untrusted data.
> >
> > 46 UVERBS_ATTR_ALLOC_DMAH_CPU_ID);
> > 47 if (ret)
> > 48 goto err;
> > 49
> > --> 50 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
> > ^^^^^^^^^^^^
> > You can't pass untrusted data to cpumask_test_cpu() or it results in
> > possibly a WARN_ON() (most people have reboot on WARN enabled) and
> > and out of bounds access.
>
> Thanks Dan for your report.
>
> It seems that the below [1] chunk should solve the issue.
>
> Would you like please to send a fixup patch having it ?
>
If you could take care of it that would be great, thanks. I'm
trying to scale my process to compete with Sashiko. :P
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-25 6:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-21 8:04 [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs Dan Carpenter
2026-05-24 7:22 ` Yishai Hadas
2026-05-25 6:52 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox