[PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[Seongjun Hong]

Use > instead of >= on boundary check of recv_buf to avoid the bug which
the full message in the last slot of recv_buf is ignored even though the
received data size does not overflow the recv_buf.

Clarify the second boundary condition by removing unnecessary division by
entry_size. It directly shows that size should be within qp->max_msg_size.

Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
---
 drivers/vfio/pci/mlx5/cmd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
index 5fe0621b5fbd..a49531666e6d 100644
--- a/drivers/vfio/pci/mlx5/cmd.c
+++ b/drivers/vfio/pci/mlx5/cmd.c
@@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
 	int i;
 
 	buf_offset = index * qp->max_msg_size;
-	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
-		    (nent > qp->max_msg_size / entry_size)))
+	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
+		    size > qp->max_msg_size))
 		return;
 
 	do {

---
base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2

Best regards,
-- 
Seongjun Hong

Re: [PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[Yishai Hadas]

On 04/10/2026 20:20, Seongjun Hong wrote:
> Use > instead of >= on boundary check of recv_buf to avoid the bug which
> the full message in the last slot of recv_buf is ignored even though the
> received data size does not overflow the recv_buf.
> 
> Clarify the second boundary condition by removing unnecessary division by
> entry_size. It directly shows that size should be within qp->max_msg_size.
> 
> Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
> Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
> ---
>   drivers/vfio/pci/mlx5/cmd.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
> index 5fe0621b5fbd..a49531666e6d 100644
> --- a/drivers/vfio/pci/mlx5/cmd.c
> +++ b/drivers/vfio/pci/mlx5/cmd.c
> @@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
>   	int i;
>   
>   	buf_offset = index * qp->max_msg_size;
> -	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
> -		    (nent > qp->max_msg_size / entry_size)))
> +	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
> +		    size > qp->max_msg_size))
>   		return;
>   
>   	do {
> 
> ---
> base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
> change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2
> 
> Best regards,

The patch should include also Cc stable for the first condition.

Reviewed-by: Yishai Hadas <yishaih@nvidia.com>

Yishai

Re: [PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[Seongjun Hong]

On Mon, Oct 05, 2026 at 06:43:08PM +0300, Yishai Hadas wrote:
> On 04/10/2026 20:20, Seongjun Hong wrote:
> > Use > instead of >= on boundary check of recv_buf to avoid the bug which
> > the full message in the last slot of recv_buf is ignored even though the
> > received data size does not overflow the recv_buf.
> > 
> > Clarify the second boundary condition by removing unnecessary division by
> > entry_size. It directly shows that size should be within qp->max_msg_size.
> > 
> > Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
> > Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
> > ---
> >   drivers/vfio/pci/mlx5/cmd.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
> > index 5fe0621b5fbd..a49531666e6d 100644
> > --- a/drivers/vfio/pci/mlx5/cmd.c
> > +++ b/drivers/vfio/pci/mlx5/cmd.c
> > @@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
> >   	int i;
> >   	buf_offset = index * qp->max_msg_size;
> > -	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
> > -		    (nent > qp->max_msg_size / entry_size)))
> > +	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
> > +		    size > qp->max_msg_size))
> >   		return;
> >   	do {
> > 
> > ---
> > base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
> > change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2
> > 
> > Best regards,
> 
> The patch should include also Cc stable for the first condition.
> 
> Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
> 
> Yishai
> 
> 

Thanks for the review. Done in v2, which also drops the second condition
change so only the fix goes to stable.

Best regards,
-- 
Seongjun Hong