[PATCH] RDMA/uverbs: Set MR iova and length in ioctl reg paths

[PATCH] RDMA/uverbs: Set MR iova and length in ioctl reg paths

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

UVERBS_METHOD_REG_MR and UVERBS_METHOD_REG_DMABUF_MR do not
initialize ib_mr->iova and ib_mr->length, unlike
ib_uverbs_reg_mr() which assigns both from the command.

Drivers that do not set these fields themselves are therefore left
with zero values. UVERBS_METHOD_QUERY_MR and RDMA netlink then report
zero iova and length. Some drivers also use these fields in their data
path; for example, rxe uses them for range validation in
mr_check_range(), causing accesses to MRs registered through these
ioctl paths to fail.

Drivers such as mlx5 that initialize the fields themselves are
unaffected.

Set iova and length in both ioctl handlers, matching the legacy
registration path.

Fixes: 5b2e45049dc0 ("IB/core: Add UVERBS_METHOD_REG_MR on the MR object")
Fixes: bfe0cc6eb249 ("RDMA/uverbs: Add uverbs command for dma-buf based MR registration")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/core/uverbs_std_types_mr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
index 0c72f80..df02488 100644
--- a/drivers/infiniband/core/uverbs_std_types_mr.c
+++ b/drivers/infiniband/core/uverbs_std_types_mr.c
@@ -247,6 +247,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_DMABUF_MR)(
 	mr->pd = pd;
 	mr->type = IB_MR_TYPE_USER;
 	mr->uobject = uobj;
+	mr->iova = iova;
+	mr->length = length;
 	atomic_inc(&pd->usecnt);
 
 	rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
@@ -374,6 +376,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_MR)(
 	mr->pd = pd;
 	mr->type = IB_MR_TYPE_USER;
 	mr->uobject = uobj;
+	mr->iova = iova;
+	mr->length = length;
 	atomic_inc(&pd->usecnt);
 	if (dmah) {
 		mr->dmah = dmah;
-- 
2.9.4

Re: [PATCH] RDMA/uverbs: Set MR iova and length in ioctl reg paths

[Leon Romanovsky]

On Fri, Sep 04, 2026 at 10:24:41AM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> UVERBS_METHOD_REG_MR and UVERBS_METHOD_REG_DMABUF_MR do not
> initialize ib_mr->iova and ib_mr->length, unlike
> ib_uverbs_reg_mr() which assigns both from the command.
> 
> Drivers that do not set these fields themselves are therefore left
> with zero values. UVERBS_METHOD_QUERY_MR and RDMA netlink then report
> zero iova and length. Some drivers also use these fields in their data
> path; for example, rxe uses them for range validation in
> mr_check_range(), causing accesses to MRs registered through these
> ioctl paths to fail.
> 
> Drivers such as mlx5 that initialize the fields themselves are
> unaffected.
> 
> Set iova and length in both ioctl handlers, matching the legacy
> registration path.

They are affected because you overwrite the fields set by an earlier
driver callback.

Thanks

> 
> Fixes: 5b2e45049dc0 ("IB/core: Add UVERBS_METHOD_REG_MR on the MR object")
> Fixes: bfe0cc6eb249 ("RDMA/uverbs: Add uverbs command for dma-buf based MR registration")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/core/uverbs_std_types_mr.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
> index 0c72f80..df02488 100644
> --- a/drivers/infiniband/core/uverbs_std_types_mr.c
> +++ b/drivers/infiniband/core/uverbs_std_types_mr.c
> @@ -247,6 +247,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_DMABUF_MR)(
>  	mr->pd = pd;
>  	mr->type = IB_MR_TYPE_USER;
>  	mr->uobject = uobj;
> +	mr->iova = iova;
> +	mr->length = length;
>  	atomic_inc(&pd->usecnt);
>  
>  	rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
> @@ -374,6 +376,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_MR)(
>  	mr->pd = pd;
>  	mr->type = IB_MR_TYPE_USER;
>  	mr->uobject = uobj;
> +	mr->iova = iova;
> +	mr->length = length;
>  	atomic_inc(&pd->usecnt);
>  	if (dmah) {
>  		mr->dmah = dmah;
> -- 
> 2.9.4
>