* [PATCH] RDMA/mthca: Fix off-by-one in mthca_map_user_db()
@ 2026-10-23 19:23 Serhat Kumral
2026-10-26 2:49 ` Chenguang Zhao
0 siblings, 1 reply; 2+ messages in thread
From: Serhat Kumral @ 2026-10-23 19:23 UTC (permalink / raw)
To: jgg, leon; +Cc: linux-rdma, linux-kernel, Serhat Kumral
db_tab->page[] has uarc_size / MTHCA_ICM_PAGE_SIZE elements, so valid
doorbell indices are in the range [0, uarc_size / 8 - 1]. Allowing
index == uarc_size / 8 results in an out-of-bounds access at
db_tab->page[npages]. Use '>=' instead of '>' in the bounds check.
Fixes: 56483ec1b702 ("[PATCH] IB uverbs: add mthca user doorbell record support")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
drivers/infiniband/hw/mthca/mthca_memfree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 9c5eb03f354d..39d82dc73807 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -453,7 +453,7 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
if (!mthca_is_memfree(dev))
return 0;
- if (index < 0 || index > dev->uar_table.uarc_size / 8)
+ if (index < 0 || index >= dev->uar_table.uarc_size / 8)
return -EINVAL;
mutex_lock(&db_tab->mutex);
--
2.53.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] RDMA/mthca: Fix off-by-one in mthca_map_user_db()
2026-10-23 19:23 [PATCH] RDMA/mthca: Fix off-by-one in mthca_map_user_db() Serhat Kumral
@ 2026-10-26 2:49 ` Chenguang Zhao
0 siblings, 0 replies; 2+ messages in thread
From: Chenguang Zhao @ 2026-10-26 2:49 UTC (permalink / raw)
To: Serhat Kumral; +Cc: jgg, leon, linux-rdma, linux-kernel
On Fri, Oct 23, 2026 at 10:23:48PM +0300, Serhat Kumral wrote:
> db_tab->page[] has uarc_size / MTHCA_ICM_PAGE_SIZE elements, so valid
> doorbell indices are in the range [0, uarc_size / 8 - 1]. Allowing
> index == uarc_size / 8 results in an out-of-bounds access at
> db_tab->page[npages]. Use '>=' instead of '>' in the bounds check.
>
> Fixes: 56483ec1b702 ("[PATCH] IB uverbs: add mthca user doorbell record support")
> Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
> ---
> drivers/infiniband/hw/mthca/mthca_memfree.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
> index 9c5eb03f354d..39d82dc73807 100644
> --- a/drivers/infiniband/hw/mthca/mthca_memfree.c
> +++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
> @@ -453,7 +453,7 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
> if (!mthca_is_memfree(dev))
> return 0;
>
> - if (index < 0 || index > dev->uar_table.uarc_size / 8)
> + if (index < 0 || index >= dev->uar_table.uarc_size / 8)
> return -EINVAL;
>
> mutex_lock(&db_tab->mutex);
> --
> 2.53.0
>
LGTM
Reviewed-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Thanks
Chenguang
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-26 2:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-23 19:23 [PATCH] RDMA/mthca: Fix off-by-one in mthca_map_user_db() Serhat Kumral
2026-10-26 2:49 ` Chenguang Zhao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®