linux-kernel - RDMA/mlx5: issue with error checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <79166fb1-3b73-4d37-af02-a17b22eb8e64@gmail.com>
Date: Thu, 17 Jul 2025 12:36:06 +0100
From: "Colin King (gmail)" <colin.i.king@...il.com>
To: Edward Srouji <edwards@...dia.com>,
 Michael Guralnik <michaelgur@...dia.com>
Cc: Leon Romanovsky <leon@...nel.org>, Jason Gunthorpe <jgg@...pe.ca>,
 linux-rdma@...r.kernel.org,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RDMA/mlx5: issue with error checking

Hi

Static analysis detected an issue with the following commit:

commit e73242aa14d2ec7f4a1a13688366bb36dc0fe5b7
Author: Edward Srouji <edwards@...dia.com>
Date:   Wed Jul 9 09:42:11 2025 +0300

     RDMA/mlx5: Optimize DMABUF mkey page size


The issue is as follows:

int mlx5r_umr_dmabuf_update_pgsz(struct mlx5_ib_mr *mr, u32 xlt_flags,
                                  unsigned int page_shift)
{
         unsigned int old_page_shift = mr->page_shift;
         size_t zapped_blocks;
         size_t total_blocks;
         int err;

         zapped_blocks = _mlx5r_umr_zap_mkey(mr, xlt_flags, page_shift,
                                             mr->data_direct);
         if (zapped_blocks < 0)
                 return zapped_blocks;

The variable zapped_blocks is a size_t type and is being assigned a int 
return value from the call to _mlx5r_umr_zap_mkey. Since zapped_blocks 
is an unsigned type, the error check for zapped_blocks < 0 will never be 
true.  I suspect total_blocks should be a ssize_t type, but that 
probably also means total_blocks should be ssize_t too, but don't have 
the hardware to test this fix and I'm concerned that this change may 
break the code. Hence I'm reporting this issue.

Colin



Download attachment "OpenPGP_0x68C287DFC6A80226.asc" of type "application/pgp-keys" (4825 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)