RE: [PATCH] RDMA/siw: Fix potential page_array out of range access

[Bernard Metzler]

> -----Original Message-----
> From: Daniil Dulov <d.dulov@xxxxxxxxxx>
> Sent: Monday, 27 February 2023 10:18
> To: Bernard Metzler <BMT@xxxxxxxxxxxxxx>
> Cc: Daniil Dulov <d.dulov@xxxxxxxxxx>; Doug Ledford <dledford@xxxxxxxxxx>;
> Jason Gunthorpe <jgg@xxxxxxxx>; linux-rdma@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; lvc-project@xxxxxxxxxxxxxxxx
> Subject: [EXTERNAL] [PATCH] RDMA/siw: Fix potential page_array out of range
> access
> 
> When seg is equal to MAX_ARRAY, the loop should break, otherwise
> it will result in out of range access.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
> Signed-off-by: Daniil Dulov <d.dulov@xxxxxxxxxx>
> ---
>  drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c
> b/drivers/infiniband/sw/siw/siw_qp_tx.c
> index 3c3ae5ef2942..f9eb314c6e14 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_tx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
> @@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct
> socket *s)
>  			data_len -= plen;
>  			fp_off = 0;
> 
> -			if (++seg > (int)MAX_ARRAY) {
> +			if (++seg == (int)MAX_ARRAY) {

Absolutely! For superstitious people like me,
maybe even write '>=' here. Thank you!

>  				siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
>  				siw_unmap_pages(page_array, kmap_mask);
>  				wqe->processed -= c_tx->bytes_unsent;
> --
> 2.25.1