Re: [PATCH rdma-next] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

[Leon Romanovsky]

On Sun, 26 Jul 2026 12:13:55 +0300, Leon Romanovsky wrote:
> get_param() reads a congestion parameter as a u32 but formats it with the
> signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as
> 0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf()
> stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12
> bytes as valid and reads one byte past lbuf[].
> 
> Size the buffer for the widest unsigned decimal, format with "%u" to match
> the u32, and use scnprintf() so the length passed to
> simple_read_from_buffer() reflects the bytes actually stored.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
      https://git.kernel.org/rdma/rdma/c/03826bc1fa6c90

Best regards,
-- 
Leon Romanovsky <leonro@xxxxxxxxxx>