Re: [PATCH rdma-next 2/2] RDMA/mlx5: Fix integer overflow of user QP buffer size

[Jason Gunthorpe]

On Thu, Jun 11, 2026 at 03:50:43PM +0300, Edward Srouji wrote:
> @@ -664,11 +666,36 @@ static int set_user_buf_size(struct mlx5_ib_dev *dev,
>  
>  	if (attr->qp_type == IB_QPT_RAW_PACKET ||
>  	    qp->flags & IB_QP_CREATE_SOURCE_QPN) {
> -		base->ubuffer.buf_size = qp->rq.wqe_cnt << qp->rq.wqe_shift;
> -		qp->raw_packet_qp.sq.ubuffer.buf_size = qp->sq.wqe_cnt << 6;
> +		if (check_shl_overflow(qp->rq.wqe_cnt, qp->rq.wqe_shift,
> +				       &base->ubuffer.buf_size)) {
> +			mlx5_ib_warn(dev, "rq buf size overflow: wqe_cnt %d wqe_shift %d\n",
> +				     qp->rq.wqe_cnt, qp->rq.wqe_shift);
> +			return -EINVAL;

No prints triggerable by uapi.

Jason