[PATCH rdma-next v2 0/3] RDMA: Fix DEVX UMEM mailbox size overflow

[PATCH rdma-next v2 0/3] RDMA: Fix DEVX UMEM mailbox size overflow

[Edward Srouji]

Registering a DEVX UMEM builds a CREATE_UMEM mailbox whose size grows
with the number of MTTs, i.e. with the user-supplied length and
pgsz_bitmap. The size is stored in a u32, so a UMEM of about 2TB with
4KB pages wraps it, the mailbox is under-allocated and
mlx5_ib_populate_pas() writes past its end.

Patch 1 fixes a pre-existing issue in the same path, reported by Sashiko
on v1: devx_umem_find_best_pgsize() can return a page size that is not
in the user's pgsz_bitmap.

Patch 2 computes the mailbox size with the saturating size_mul() and
size_add() helpers and rejects UMEMs whose mailbox exceeds INT_MAX, the
largest in_size mlx5_cmd_exec() accepts.

Patch 3 handles the remaining corner: _uverbs_alloc() adds a small
header to the request before calling kvmalloc(), so a mailbox just
under INT_MAX can still push kvmalloc() over its INT_MAX limit and
trigger a WARN. Since these sizes come from userspace, the allocation
now uses __GFP_NOWARN and fails with -ENOMEM.

Mailbox sizes within 512 bytes of INT_MAX also overflow the block count
in mlx5_calc_cmd_blocks(). That predates this series and fails safely
with -ENOMEM before the command reaches firmware, so it is left for a
separate mlx5_core change.

The overflow was found with an AI-assisted static analysis tool and
confirmed by code review.

Patch 2 relies on size_mul() and size_add(), so stable trees older than
5.18 will need a manual backport.

Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
Changes in v2:
- Keep cmd->inlen unsigned and bound the mailbox size explicitly
- Add patch 1 to respect pgsz_bitmap when reducing the page size
  (Sashiko)
- Link to v1: https://lore.kernel.org/r/20261109-devx-umem-mailbox-overflow-v1-0-4a63baab25dc@nvidia.com

---
Edward Srouji (1):
      RDMA/mlx5: Respect pgsz_bitmap when reducing the DEVX UMEM page size

Uri Dar (2):
      RDMA/mlx5: Fix DEVX UMEM mailbox size truncation
      RDMA/core: Don't warn on oversized bundle allocations

 drivers/infiniband/core/ib_core_uverbs.c |  2 +-
 drivers/infiniband/hw/mlx5/devx.c        | 23 ++++++++++++++++-------
 2 files changed, 17 insertions(+), 8 deletions(-)
---
base-commit: e50525a486300e5ff8014c9985b8477b2fca0368
change-id: 20261109-devx-umem-mailbox-overflow-c741bc73deb4

Best regards,
-- 
Edward Srouji <edwards@nvidia.com>

[PATCH rdma-next v2 1/3] RDMA/mlx5: Respect pgsz_bitmap when reducing the DEVX UMEM page size

[Edward Srouji]

devx_umem_find_best_pgsize() starts from the largest usable page size
allowed by the user's pgsz_bitmap and halves it until the umem starts
on a page boundary and its length is a multiple of the page size. The
halving ignores pgsz_bitmap, so the umem can be created with a page
size userspace did not allow, although the bitmap is meant to reflect
the HW limits of the intended use of the umem.

Step down to the next smaller size in pgsz_bitmap instead, and fail
the registration if none is left. The default bitmap includes every
power-of-two page size from 4K up, so the result is unchanged when
userspace does not pass one.

The Sashiko AI reviewer found this while reviewing another DEVX UMEM
patch.

Fixes: 7610ab57de56 ("RDMA/mlx5: Allow larger pages in DevX umem")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-rdma/sashiko-outbox-205134@kernel.org/
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
 drivers/infiniband/hw/mlx5/devx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index fc6f793dcc6584e6a22b40c57e2df8f24579eb14..6c34f2c2a91d0be26352100c243f24789feab3db 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2320,8 +2320,12 @@ static unsigned int devx_umem_find_best_pgsize(struct ib_umem *umem,
 	 */
 	while ((ib_umem_dma_offset(umem, page_size) != 0 ||
 		(umem->length % page_size) != 0) &&
-		page_size > PAGE_SIZE)
-		page_size /= 2;
+		page_size > PAGE_SIZE) {
+		pgsz_bitmap &= page_size - 1;
+		if (!pgsz_bitmap)
+			return 0;
+		page_size = rounddown_pow_of_two(pgsz_bitmap);
+	}
 
 	return page_size;
 }

-- 
2.49.0

[PATCH rdma-next v2 2/3] RDMA/mlx5: Fix DEVX UMEM mailbox size truncation

[Edward Srouji]

From: Uri Dar <udar@nvidia.com>

devx_umem_reg_cmd_alloc() stores the CREATE_UMEM mailbox size, a header
plus 8 bytes per MTT, in the u32 cmd->inlen. The number of MTTs is
derived from the user-supplied length and pgsz_bitmap, so a UMEM of about
2TB registered with 4KB pages wraps the size, the mailbox is
under-allocated and mlx5_ib_populate_pas() writes past its end.

Compute the size with the saturating size_mul() and size_add() helpers
and reject a UMEM whose mailbox exceeds INT_MAX, the largest in_size
mlx5_cmd_exec() accepts.

Mailbox sizes within 512 bytes of INT_MAX still overflow the block count
in mlx5_calc_cmd_blocks(), but the command then fails with -ENOMEM
before reaching firmware. This predates the change.

Fixes: aeae94579caf ("IB/mlx5: Add DEVX support for memory registration")
Cc: stable@vger.kernel.org
Signed-off-by: Uri Dar <udar@nvidia.com>
Reviewed-by: Michael Gur <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
 drivers/infiniband/hw/mlx5/devx.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 6c34f2c2a91d0be26352100c243f24789feab3db..030aa2cbdc2a7a5d0148de6af1bcd929ac7e444f 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2338,6 +2338,8 @@ static int devx_umem_reg_cmd_alloc(struct mlx5_ib_dev *dev,
 {
 	unsigned long pgsz_bitmap;
 	unsigned int page_size;
+	size_t num_mtt;
+	size_t inlen;
 	__be64 *mtt;
 	void *umem;
 	int ret;
@@ -2365,9 +2367,13 @@ static int devx_umem_reg_cmd_alloc(struct mlx5_ib_dev *dev,
 	if (!page_size)
 		return -EINVAL;
 
-	cmd->inlen = MLX5_ST_SZ_BYTES(create_umem_in) +
-		     (MLX5_ST_SZ_BYTES(mtt) *
-		      ib_umem_num_dma_blocks(obj->umem, page_size));
+	num_mtt = ib_umem_num_dma_blocks(obj->umem, page_size);
+	inlen = size_add(MLX5_ST_SZ_BYTES(create_umem_in),
+			 size_mul(MLX5_ST_SZ_BYTES(mtt), num_mtt));
+	if (inlen > INT_MAX)
+		return -EINVAL;
+
+	cmd->inlen = inlen;
 	cmd->in = uverbs_zalloc(attrs, cmd->inlen);
 	if (IS_ERR(cmd->in))
 		return PTR_ERR(cmd->in);
@@ -2376,8 +2382,7 @@ static int devx_umem_reg_cmd_alloc(struct mlx5_ib_dev *dev,
 	mtt = (__be64 *)MLX5_ADDR_OF(umem, umem, mtt);
 
 	MLX5_SET(create_umem_in, cmd->in, opcode, MLX5_CMD_OP_CREATE_UMEM);
-	MLX5_SET64(umem, umem, num_of_mtt,
-		   ib_umem_num_dma_blocks(obj->umem, page_size));
+	MLX5_SET64(umem, umem, num_of_mtt, num_mtt);
 	MLX5_SET(umem, umem, log_page_size,
 		 order_base_2(page_size) - MLX5_ADAPTER_PAGE_SHIFT);
 	MLX5_SET(umem, umem, page_offset,

-- 
2.49.0

[PATCH rdma-next v2 3/3] RDMA/core: Don't warn on oversized bundle allocations

[Edward Srouji]

From: Uri Dar <udar@nvidia.com>

_uverbs_alloc() serves requests that do not fit in the bundle's internal
buffer from kvmalloc(), prepending a small list header. The requested
size can be derived from userspace input, and since commit 7661809d493b
("mm: don't allow oversized kvmalloc() calls") kvmalloc() WARNs on any
request above INT_MAX unless __GFP_NOWARN is given.

mlx5 DEVX UMEM registration is one such caller: its CREATE_UMEM mailbox
scales with the size of the user's UMEM, and a mailbox that passes the
driver's INT_MAX check can still exceed INT_MAX once the header is
added.

As with memdup_user(), an allocation sized by userspace should fail
quietly rather than warn. Pass __GFP_NOWARN so such requests fail with
-ENOMEM.

Fixes: 461bb2eee4e1 ("IB/uverbs: Add a simple allocator to uverbs_attr_bundle")
Signed-off-by: Uri Dar <udar@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
 drivers/infiniband/core/ib_core_uverbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/ib_core_uverbs.c b/drivers/infiniband/core/ib_core_uverbs.c
index 74d9c006bad5aa5d8366b1b75843c9873c62c344..c41b77d7084034613678e8b4b25bc95f72c8e241 100644
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -554,7 +554,7 @@ __malloc void *_uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size,
 	if (new_used > pbundle->internal_avail) {
 		struct bundle_alloc_head *buf;
 
-		buf = kvmalloc_flex(*buf, data, size, flags);
+		buf = kvmalloc_flex(*buf, data, size, flags | __GFP_NOWARN);
 		if (!buf)
 			return ERR_PTR(-ENOMEM);
 		buf->next = pbundle->allocated_mem;

-- 
2.49.0