When seg is equal to MAX_ARRAY, the loop should break, otherwise
it will result in out of range access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
---
 drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
index 3c3ae5ef2942..f9eb314c6e14 100644
--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
@@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
 			data_len -= plen;
 			fp_off = 0;
 
-			if (++seg > (int)MAX_ARRAY) {
+			if (++seg == (int)MAX_ARRAY) {
 				siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
 				siw_unmap_pages(page_array, kmap_mask);
 				wqe->processed -= c_tx->bytes_unsent;
-- 
2.25.1

On Mon, Feb 27, 2023 at 01:17:51AM -0800, Daniil Dulov wrote:
> When seg is equal to MAX_ARRAY, the loop should break, otherwise
> it will result in out of range access.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
> Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
> ---
>  drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Thanks, applied and changed as Bernard suggested.

> -----Original Message-----
> From: Daniil Dulov <d.dulov@aladdin.ru>
> Sent: Monday, 27 February 2023 10:18
> To: Bernard Metzler <BMT@zurich.ibm.com>
> Cc: Daniil Dulov <d.dulov@aladdin.ru>; Doug Ledford <dledford@redhat.com>;
> Jason Gunthorpe <jgg@ziepe.ca>; linux-rdma@vger.kernel.org; linux-
> kernel@vger.kernel.org; lvc-project@linuxtesting.org
> Subject: [EXTERNAL] [PATCH] RDMA/siw: Fix potential page_array out of range
> access
> 
> When seg is equal to MAX_ARRAY, the loop should break, otherwise
> it will result in out of range access.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
> Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
> ---
>  drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c
> b/drivers/infiniband/sw/siw/siw_qp_tx.c
> index 3c3ae5ef2942..f9eb314c6e14 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_tx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
> @@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct
> socket *s)
>  			data_len -= plen;
>  			fp_off = 0;
> 
> -			if (++seg > (int)MAX_ARRAY) {
> +			if (++seg == (int)MAX_ARRAY) {

Absolutely! For superstitious people like me,
maybe even write '>=' here. Thank you!

>  				siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
>  				siw_unmap_pages(page_array, kmap_mask);
>  				wqe->processed -= c_tx->bytes_unsent;
> --
> 2.25.1