Re: [PATCH v2] RDMA/srpt: bound the indirect descriptor table and widen the counters

[Bart Van Assche]

On 10/20/26 5:18 PM, Yehyeong Lee wrote:
>    BUG: KASAN: slab-out-of-bounds in srpt_alloc_rw_ctxs+0x6ee/0x950
>    Read of size 4 at addr 000000006318205c by task kunit_try_catch/33

Some feedback about this patch:
* Since this patch fixes two separate bugs, should it perhaps be split
  into two patches? The fixed issues are:
   - The missing bound on the descriptor table goes back to
     commit a42d985bd5b2. The original code did `memcpy(ioctx->rbufs,
     db, n_rbuf * sizeof *db)` with the same missing check.
   - The `u8` `n_rw_ctx`/`n_rdma` counters came in with commit
     b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE
     API").
* n_rdma can overflow without many descriptors. It is the sum of
  rdma_rw_ctx_init() return values (work requests per context), and that
  can exceed 255 even for a few large descriptors. Widening it fixes
  more than the commit message says; please mention that.
* The `idb` header ends at most at offset 320, and `MIN_MAX_REQ_SIZE` is
  996, so reading it is never out of bounds; at worst it reads stale
  data. The extra check is fine, but both checks could be folded into
  one, placed after the existing descriptor-count check.

Thanks,

Bart.