Use > instead of >= on boundary check of recv_buf to avoid the bug which the full message in the last slot of recv_buf is ignored even though the received data size does not overflow the recv_buf. Clarify the second boundary condition by removing unnecessary division by entry_size. It directly shows that size should be within qp->max_msg_size. Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability") Signed-off-by: Seongjun Hong --- drivers/vfio/pci/mlx5/cmd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c index 5fe0621b5fbd..a49531666e6d 100644 --- a/drivers/vfio/pci/mlx5/cmd.c +++ b/drivers/vfio/pci/mlx5/cmd.c @@ -1644,8 +1644,8 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp, int i; buf_offset = index * qp->max_msg_size; - if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE || - (nent > qp->max_msg_size / entry_size))) + if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE || + size > qp->max_msg_size)) return; do { --- base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84 change-id: 20261004-vfio-mlx5-fix-boundary-check-4839d6aecbe2 Best regards, -- Seongjun Hong