Re: [bug report] RDMA/core: Introduce a DMAH object and its alloc/free APIs

[Yishai Hadas <yishaih@nvidia.com>]

On 21/05/2026 11:04, Dan Carpenter wrote:
> Hello Yishai Hadas,
> 
> Commit d83edab562a4 ("RDMA/core: Introduce a DMAH object and its
> alloc/free APIs") from Jul 17, 2025 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	drivers/infiniband/core/uverbs_std_types_dmah.c:50 ib_uverbs_handler_UVERBS_METHOD_DMAH_ALLOC()
> 	error: passing untrusted data 'dmah->cpu_id' to 'cpumask_test_cpu()'
> 
> drivers/infiniband/core/uverbs_std_types_dmah.c
>      40         dmah = rdma_zalloc_drv_obj(ib_dev, ib_dmah);
>      41         if (!dmah)
>      42                 return -ENOMEM;
>      43
>      44         if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_CPU_ID)) {
>      45                 ret = uverbs_copy_from(&dmah->cpu_id, attrs,
>                                                ^^^^^^^^^^^^^
> cpu_id is untrusted data.
> 
>      46                                        UVERBS_ATTR_ALLOC_DMAH_CPU_ID);
>      47                 if (ret)
>      48                         goto err;
>      49
> --> 50                 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
>                                               ^^^^^^^^^^^^
> You can't pass untrusted data to cpumask_test_cpu() or it results in
> possibly a WARN_ON() (most people have reboot on WARN enabled) and
> and out of bounds access.

Thanks Dan for your report.

It seems that the below [1] chunk should solve the issue.

Would you like please to send a fixup patch having it ?

[1]
diff --git a/drivers/infiniband/core/uverbs_std_types_dmah.c 
b/drivers/infiniband/core/uverbs_std_types_dmah.c
index 453ce656c6f2..97101e093826 100644
--- a/drivers/infiniband/core/uverbs_std_types_dmah.c
+++ b/drivers/infiniband/core/uverbs_std_types_dmah.c
@@ -47,6 +47,11 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DMAH_ALLOC)(
                 if (ret)
                         goto err;

+               if (dmah->cpu_id >= nr_cpu_ids) {
+                       ret = -EINVAL;
+                       goto err;
+               }
+
                 if (!cpumask_test_cpu(dmah->cpu_id, current->cpus_ptr)) {
                         ret = -EPERM;
                         goto err;

Yishai

> 
>      51                         ret = -EPERM;
>      52                         goto err;
>      53                 }
>      54
>      55                 dmah->valid_fields |= BIT(IB_DMAH_CPU_ID_EXISTS);
>      56         }
>      57
>      58         if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE)) {
>      59                 dmah->mem_type = uverbs_attr_get_enum_id(attrs,
>      60                                         UVERBS_ATTR_ALLOC_DMAH_TPH_MEM_TYPE);
> 
> This email is a free service from the Smatch-CI project [smatch.sf.net].
> 
> regards,
> dan carpenter