Re: [PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[Yishai Hadas <yishaih@nvidia.com>]

On 04/10/2026 20:20, Seongjun Hong wrote:
> Use > instead of >= on boundary check of recv_buf to avoid the bug which
> the full message in the last slot of recv_buf is ignored even though the
> received data size does not overflow the recv_buf.
> 
> Clarify the second boundary condition by removing unnecessary division by
> entry_size. It directly shows that size should be within qp->max_msg_size.
> 
> Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
> Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
> ---
>   drivers/vfio/pci/mlx5/cmd.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
> index 5fe0621b5fbd..a49531666e6d 100644
> --- a/drivers/vfio/pci/mlx5/cmd.c
> +++ b/drivers/vfio/pci/mlx5/cmd.c
> @@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
>   	int i;
>   
>   	buf_offset = index * qp->max_msg_size;
> -	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
> -		    (nent > qp->max_msg_size / entry_size)))
> +	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
> +		    size > qp->max_msg_size))
>   		return;
>   
>   	do {
> 
> ---
> base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
> change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2
> 
> Best regards,

The patch should include also Cc stable for the first condition.

Reviewed-by: Yishai Hadas <yishaih@nvidia.com>

Yishai