Re: [PATCH V1 rdma-next 19/24] RDMA/mlx5: Validate firmware RQ/SQ state before sqrq_trans[] lookup

[Yishai Hadas <yishaih@nvidia.com>]

On 11/11/2026 15:46, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] RDMA/mlx5: missing Fixes trailer for sqrq_state_to_qp_state()
>    bounds check
> --
> 
> commit 8e8f815c736eddc60d07600341bb9a6f00977b7c
> Author: Yishai Hadas <yishaih@nvidia.com>
> 
>> RDMA/mlx5: Validate firmware RQ/SQ state before sqrq_trans[] lookup
>>
>> sqrq_state_to_qp_state() indexes the 5x5 sqrq_trans[] table with the RQ
>> and SQ states returned by QUERY_RQ and QUERY_SQ. The state fields are 4
>> bits wide, so an untrusted NIC can return a state above 4 and the lookup
>> reads past the table.
>>
>> Reject out of range states with -EIO before the lookup.
>>
>> Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
> 
> [Severity: Low]
> Since this fixes an out-of-bounds read in sqrq_state_to_qp_state(), should it
> include:
> 
>    Fixes: 6d2f89df04b7 ("IB/mlx5: Add Raw Packet QP query functionality")
> 

The existing code is correct, as it trusts the firmware. This is 
hardening for adversarial mode, so no Fixes tag is needed.

Yishai