Re: [PATCH] vfio/mlx5: Fix boundary check in set_report_output()

[Seongjun Hong]

On Mon, Oct 05, 2026 at 06:43:08PM +0300, Yishai Hadas wrote:
> On 04/10/2026 20:20, Seongjun Hong wrote:
> > Use > instead of >= on boundary check of recv_buf to avoid the bug which
> > the full message in the last slot of recv_buf is ignored even though the
> > received data size does not overflow the recv_buf.
> > 
> > Clarify the second boundary condition by removing unnecessary division by
> > entry_size. It directly shows that size should be within qp->max_msg_size.
> > 
> > Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
> > Signed-off-by: Seongjun Hong <hsj0512@xxxxxxxxx>
> > ---
> >   drivers/vfio/pci/mlx5/cmd.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
> > index 5fe0621b5fbd..a49531666e6d 100644
> > --- a/drivers/vfio/pci/mlx5/cmd.c
> > +++ b/drivers/vfio/pci/mlx5/cmd.c
> > @@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
> >   	int i;
> >   	buf_offset = index * qp->max_msg_size;
> > -	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
> > -		    (nent > qp->max_msg_size / entry_size)))
> > +	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
> > +		    size > qp->max_msg_size))
> >   		return;
> >   	do {
> > 
> > ---
> > base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
> > change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2
> > 
> > Best regards,
> 
> The patch should include also Cc stable for the first condition.
> 
> Reviewed-by: Yishai Hadas <yishaih@xxxxxxxxxx>
> 
> Yishai
> 
> 

Thanks for the review. Done in v2, which also drops the second condition
change so only the fix goes to stable.

Best regards,
-- 
Seongjun Hong