Re: [PATCH] RDMA/uverbs: Set MR iova and length in ioctl reg paths

[Leon Romanovsky <leon@kernel.org>]

On Fri, Sep 04, 2026 at 10:24:41AM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> UVERBS_METHOD_REG_MR and UVERBS_METHOD_REG_DMABUF_MR do not
> initialize ib_mr->iova and ib_mr->length, unlike
> ib_uverbs_reg_mr() which assigns both from the command.
> 
> Drivers that do not set these fields themselves are therefore left
> with zero values. UVERBS_METHOD_QUERY_MR and RDMA netlink then report
> zero iova and length. Some drivers also use these fields in their data
> path; for example, rxe uses them for range validation in
> mr_check_range(), causing accesses to MRs registered through these
> ioctl paths to fail.
> 
> Drivers such as mlx5 that initialize the fields themselves are
> unaffected.
> 
> Set iova and length in both ioctl handlers, matching the legacy
> registration path.

They are affected because you overwrite the fields set by an earlier
driver callback.

Thanks

> 
> Fixes: 5b2e45049dc0 ("IB/core: Add UVERBS_METHOD_REG_MR on the MR object")
> Fixes: bfe0cc6eb249 ("RDMA/uverbs: Add uverbs command for dma-buf based MR registration")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/core/uverbs_std_types_mr.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
> index 0c72f80..df02488 100644
> --- a/drivers/infiniband/core/uverbs_std_types_mr.c
> +++ b/drivers/infiniband/core/uverbs_std_types_mr.c
> @@ -247,6 +247,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_DMABUF_MR)(
>  	mr->pd = pd;
>  	mr->type = IB_MR_TYPE_USER;
>  	mr->uobject = uobj;
> +	mr->iova = iova;
> +	mr->length = length;
>  	atomic_inc(&pd->usecnt);
>  
>  	rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
> @@ -374,6 +376,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_MR)(
>  	mr->pd = pd;
>  	mr->type = IB_MR_TYPE_USER;
>  	mr->uobject = uobj;
> +	mr->iova = iova;
> +	mr->length = length;
>  	atomic_inc(&pd->usecnt);
>  	if (dmah) {
>  		mr->dmah = dmah;
> -- 
> 2.9.4
>