[PATCH] RDMA/mad: Reject receive completions shorter than GRH

[PATCH] RDMA/mad: Reject receive completions shorter than GRH

[Jiale Yao]

ib_mad_recv_done() derives the OPA MAD length by subtracting the GRH
size from wc->byte_len without ensuring the receive completion covers
the GRH. If it is shorter, the subtraction wraps before the result is
stored in mad_len and an invalid length can be passed downstream.

Reject receive completions shorter than the GRH before inspecting the
MAD header or deriving the MAD length.

Fixes: 8e4349d13f33 ("IB/mad: Add final OPA MAD processing")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/infiniband/core/mad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 3c91f00d09c6..8124e0b5a87d 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2342,6 +2342,8 @@ static void ib_mad_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 			    recv->header.mapping,
 			    mad_priv_dma_size(recv),
 			    DMA_FROM_DEVICE);
+	if (unlikely(wc->byte_len < sizeof(struct ib_grh)))
+		goto out;
 
 	/* Setup MAD receive work completion from "normal" work completion */
 	recv->header.wc = *wc;
-- 
2.34.1

Re: [PATCH] RDMA/mad: Reject receive completions shorter than GRH

[Leon Romanovsky]

On Sat, 26 Sep 2026 18:59:25 +0800, Jiale Yao wrote:
> ib_mad_recv_done() derives the OPA MAD length by subtracting the GRH
> size from wc->byte_len without ensuring the receive completion covers
> the GRH. If it is shorter, the subtraction wraps before the result is
> stored in mad_len and an invalid length can be passed downstream.
> 
> Reject receive completions shorter than the GRH before inspecting the
> MAD header or deriving the MAD length.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mad: Reject receive completions shorter than GRH
      https://git.kernel.org/rdma/rdma/c/2dc2126e690203

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>