[PATCH rdma-next] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

[PATCH rdma-next] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

get_param() reads a congestion parameter as a u32 but formats it with the
signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as
0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf()
stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12
bytes as valid and reads one byte past lbuf[].

Size the buffer for the widest unsigned decimal, format with "%u" to match
the u32, and use scnprintf() so the length passed to
simple_read_from_buffer() reflects the bytes actually stored.

Fixes: 4a2da0b8c0782 ("IB/mlx5: Add debug control parameters for congestion control")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx5/cong.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/cong.c b/drivers/infiniband/hw/mlx5/cong.c
index d0edf83a2f20..113e5f5fc6fb 100644
--- a/drivers/infiniband/hw/mlx5/cong.c
+++ b/drivers/infiniband/hw/mlx5/cong.c
@@ -399,15 +399,13 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count,
 	int offset = param->offset;
 	u32 var = 0;
 	int ret;
-	char lbuf[11];
+	char lbuf[12];
 
 	ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var);
 	if (ret)
 		return ret;
 
-	ret = snprintf(lbuf, sizeof(lbuf), "%d\n", var);
-	if (ret < 0)
-		return ret;
+	ret = scnprintf(lbuf, sizeof(lbuf), "%u\n", var);
 
 	return simple_read_from_buffer(buf, count, pos, lbuf, ret);
 }

---
base-commit: 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16
change-id: 20260726-get-param-leaks-kernel-stack-memory-6b8c813fe849

Best regards,
--  
Leon Romanovsky <leonro@nvidia.com>

Re: [PATCH rdma-next] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

[Leon Romanovsky]

On Sun, 26 Jul 2026 12:13:55 +0300, Leon Romanovsky wrote:
> get_param() reads a congestion parameter as a u32 but formats it with the
> signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as
> 0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf()
> stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12
> bytes as valid and reads one byte past lbuf[].
> 
> Size the buffer for the widest unsigned decimal, format with "%u" to match
> the u32, and use scnprintf() so the length passed to
> simple_read_from_buffer() reflects the bytes actually stored.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
      https://git.kernel.org/rdma/rdma/c/03826bc1fa6c90

Best regards,
-- 
Leon Romanovsky <leonro@nvidia.com>