[PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration

[PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration

[Junrui Luo]

hns_roce_hw_v2_get_cfg() writes IRQ vector numbers into hr_dev->irq[]
using handle->rinfo.num_vectors as the loop bound. num_vectors originates
from firmware via hclge_query_pf_resource() without validation against
the array size.

If firmware reports more than 128 MSI-X vectors for RoCE, the loop
overflows hr_dev->irq[], corrupting adjacent struct members in the
heap-allocated hns_roce_dev structure.

Fix by clamping num_vectors to HNS_ROCE_MAX_IRQ_NUM before the loop.

Fixes: 0b567cde9d7a ("RDMA/hns: Enable RoCE on virtual functions")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index fa36700d0db2..6983f39d7333 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -7288,6 +7288,12 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev,
 	addrconf_addr_eui48((u8 *)&hr_dev->ib_dev.node_guid,
 			    hr_dev->iboe.netdevs[0]->dev_addr);
 
+	if (handle->rinfo.num_vectors > HNS_ROCE_MAX_IRQ_NUM) {
+		dev_warn(hr_dev->dev, "num_vectors %d exceeds max %d, clamping\n",
+			 handle->rinfo.num_vectors, HNS_ROCE_MAX_IRQ_NUM);
+		handle->rinfo.num_vectors = HNS_ROCE_MAX_IRQ_NUM;
+	}
+
 	for (i = 0; i < handle->rinfo.num_vectors; i++)
 		hr_dev->irq[i] = pci_irq_vector(handle->pdev,
 						i + handle->rinfo.base_vector);

---
base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d
change-id: 20260405-fixes-c71ff838a5f6

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration

[Leon Romanovsky]

On Sun, Apr 05, 2026 at 04:15:44PM +0800, Junrui Luo wrote:
> hns_roce_hw_v2_get_cfg() writes IRQ vector numbers into hr_dev->irq[]
> using handle->rinfo.num_vectors as the loop bound. num_vectors originates
> from firmware via hclge_query_pf_resource() without validation against
> the array size.
> 
> If firmware reports more than 128 MSI-X vectors for RoCE, the loop
> overflows hr_dev->irq[], corrupting adjacent struct members in the
> heap-allocated hns_roce_dev structure.

Is this an actual issue, or just another imagined problem?

Thanks