[PATCH] RDMA/siw: Fix length of first chunk in siw_try_1seg()

[PATCH] RDMA/siw: Fix length of first chunk in siw_try_1seg()

[Serhat Kumral]

When a short-single SGE payload crosses a page boundary, siw_try_1seg()
computes the length of the first chunk as the amount that spills into
the second page instead of the amount left in the first page

	part = bytes - (PAGE_SIZE - off);

Use the remaining length of the first page as the first chunk.

Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
Assisted-by: LLM
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
 drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
index f7dd32c6e5ba..54c9d97015e8 100644
--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
@@ -85,7 +85,7 @@ static int siw_try_1seg(struct siw_iwarp_tx *c_tx, void *paddr)
 			if (likely(PAGE_SIZE - off >= bytes)) {
 				memcpy(paddr, buffer + off, bytes);
 			} else {
-				unsigned long part = bytes - (PAGE_SIZE - off);
+				unsigned long part = PAGE_SIZE - off;
 
 				memcpy(paddr, buffer + off, part);
 				kunmap_local(buffer);
-- 
2.53.0

Re: [PATCH] RDMA/siw: Fix length of first chunk in siw_try_1seg()

[Bernard Metzler]

On 27.09.2026 13:53, Serhat Kumral wrote:
> When a short-single SGE payload crosses a page boundary, siw_try_1seg()
> computes the length of the first chunk as the amount that spills into
> the second page instead of the amount left in the first page
> 
> 	part = bytes - (PAGE_SIZE - off);
> 
> Use the remaining length of the first page as the first chunk.
> 
> Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
> Assisted-by: LLM
> Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
> ---
>   drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
> index f7dd32c6e5ba..54c9d97015e8 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_tx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
> @@ -85,7 +85,7 @@ static int siw_try_1seg(struct siw_iwarp_tx *c_tx, void *paddr)
>   			if (likely(PAGE_SIZE - off >= bytes)) {
>   				memcpy(paddr, buffer + off, bytes);
>   			} else {
> -				unsigned long part = bytes - (PAGE_SIZE - off);
> +				unsigned long part = PAGE_SIZE - off;
>   
>   				memcpy(paddr, buffer + off, part);
>   				kunmap_local(buffer);

Excellent finding. Thanks very much Serhat.

This is quite serious, since we may copy data
from a location beyond the current page (if there
are more remaining bytes to be copied in the next
page than in the current page).

Acked-by: Bernard Metzler <bernard.metzler@linux.dev>

Re: [PATCH] RDMA/siw: Fix length of first chunk in siw_try_1seg()

[Jason Gunthorpe]

On Sun, Sep 27, 2026 at 02:53:51PM +0300, Serhat Kumral wrote:
> When a short-single SGE payload crosses a page boundary, siw_try_1seg()
> computes the length of the first chunk as the amount that spills into
> the second page instead of the amount left in the first page
> 
> 	part = bytes - (PAGE_SIZE - off);
> 
> Use the remaining length of the first page as the first chunk.
> 
> Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
> Assisted-by: LLM
> Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
> Acked-by: Bernard Metzler <bernard.metzler@linux.dev>
> ---
>  drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to for-next, thanks

Jason