Re: [PATCH rdma-next 1/2] RDMA/mlx5: Fix DEVX UMEM mailbox size truncation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] RDMA/mlx5: devx_umem_find_best_pgsize() ignores pgsz_bitmap
  after halving page_size [1]
--

commit bd5b83068caa4612b47dcf836a1a42f89cbb5cc5
Author: Uri Dar <udar@nvidia.com>

RDMA/mlx5: Fix DEVX UMEM mailbox size truncation

This commit changes cmd->inlen in struct devx_umem_reg_cmd to int and adds
overflow checks when computing the CREATE_UMEM mailbox size in
devx_umem_reg_cmd_alloc().

> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index fc6f793dcc658..1da6c0e440d6e 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c

[ ... ]

> @@ -2361,9 +2362,12 @@ static int devx_umem_reg_cmd_alloc(struct mlx5_ib_dev *dev,
>  	if (!page_size)
>  		return -EINVAL;
>  
> -	cmd->inlen = MLX5_ST_SZ_BYTES(create_umem_in) +
> -		     (MLX5_ST_SZ_BYTES(mtt) *
> -		      ib_umem_num_dma_blocks(obj->umem, page_size));
> +	num_mtt = ib_umem_num_dma_blocks(obj->umem, page_size);
> +	if (check_add_overflow(MLX5_ST_SZ_BYTES(create_umem_in),
> +			       size_mul(MLX5_ST_SZ_BYTES(mtt), num_mtt),
> +			       &cmd->inlen))
> +		return -EINVAL;

[Severity: Medium]
This problem wasn't introduced by this patch, but can
devx_umem_find_best_pgsize() return a page_size that is not set in
pgsz_bitmap [1]?

drivers/infiniband/hw/mlx5/devx.c:devx_umem_find_best_pgsize() {
	...
	page_size = ib_umem_find_best_pgoff(umem, pgsz_bitmap, U64_MAX);
	if (!page_size)
		return 0;
	...
	while ((ib_umem_dma_offset(umem, page_size) != 0 ||
		(umem->length % page_size) != 0) &&
		page_size > PAGE_SIZE)
		page_size /= 2;

	return page_size;
}

When a physically contiguous umem is registered with a restricted
MLX5_IB_ATTR_DEVX_UMEM_REG_PGSZ_BITMAP, ib_umem_find_best_pgoff() selects
the largest matching bit regardless of DMA offset or total length, and the
loop then halves page_size without checking that the reduced size is still
present in pgsz_bitmap.  devx_umem_reg_cmd_alloc() then registers the umem
with a page size that userspace excluded instead of returning -EINVAL.

[1] https://sashiko.dev/#/bug/linux-6cd20db6-58c6-4b3d-8dd9-c9ee893d4041

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-devx-umem-mailbox-overflow-v1-0-4a63baab25dc@nvidia.com?part=1