From bb75e5580b15cd23ededf15683a5ad67d7b61aab Mon Sep 17 00:00:00 2001 From: Serhat Kumral Date: Sun, 18 Oct 2026 17:49:07 +0300 Subject: [PATCH] RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler In MLX5_IB_METHOD_STEERING_ANCHOR_CREATE, the user-supplied u16 priority is passed directly to _get_flow_table() without an upper bound check. This can lead to out-of-bounds array accesses on dev->flow_db priority tables. Check that priority does not exceed MLX5_IB_FLOW_LAST_PRIO before calling _get_flow_table(), matching the existing validation in raw_fs_rule_add() and mlx5_ib_create_flow(). Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace") Signed-off-by: Serhat Kumral Link: https://patch.msgid.link/20261018144907.20123-1-serhatkumral1@gmail.com Signed-off-by: Leon Romanovsky --- drivers/infiniband/hw/mlx5/fs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c index e63fdb4bc3e3..bc2c15c7172b 100644 --- a/drivers/infiniband/hw/mlx5/fs.c +++ b/drivers/infiniband/hw/mlx5/fs.c @@ -3014,6 +3014,9 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)( if (err) return err; + if (priority > MLX5_IB_FLOW_LAST_PRIO) + return -EINVAL; + obj = kzalloc_obj(*obj); if (!obj) return -ENOMEM;