2024-04-18 16:53:04

by Konstantin Taranov

Subject: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before installing cq callbacks

From: Konstantin Taranov <[email protected]>

Add a boundary check inside mana_ib_install_cq_cb to prevent index overflow.

Fixes: 2a31c5a7e0d8 ("RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function")
Signed-off-by: Konstantin Taranov <[email protected]>
---
drivers/infiniband/hw/mana/cq.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
index 6c3bb8c..8323085 100644
--- a/drivers/infiniband/hw/mana/cq.c
+++ b/drivers/infiniband/hw/mana/cq.c
@@ -70,6 +70,8 @@ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq)
struct gdma_context *gc = mdev_to_gc(mdev);
struct gdma_queue *gdma_cq;

+ if (cq->queue.id >= gc->max_num_cqs)
+ return -EINVAL;
/* Create CQ table entry */
WARN_ON(gc->cq_table[cq->queue.id]);
gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
--
2.43.0

2024-04-23 23:50:35

by Long Li

Subject: RE: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before installing cq callbacks

> Subject: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before
> installing cq callbacks
>
> From: Konstantin Taranov <[email protected]>
>
> Add a boundary check inside mana_ib_install_cq_cb to prevent index
> overflow.

How is this condition possible that we are getting an out of bound queue id from SOC?

>
> Fixes: 2a31c5a7e0d8 ("RDMA/mana_ib: Introduce mana_ib_install_cq_cb
> helper function")
> Signed-off-by: Konstantin Taranov <[email protected]>
> ---
> drivers/infiniband/hw/mana/cq.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/infiniband/hw/mana/cq.c
> b/drivers/infiniband/hw/mana/cq.c index 6c3bb8c..8323085 100644
> --- a/drivers/infiniband/hw/mana/cq.c
> +++ b/drivers/infiniband/hw/mana/cq.c
> @@ -70,6 +70,8 @@ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev,
> struct mana_ib_cq *cq)
> struct gdma_context *gc = mdev_to_gc(mdev);
> struct gdma_queue *gdma_cq;
>
> + if (cq->queue.id >= gc->max_num_cqs)
> + return -EINVAL;
> /* Create CQ table entry */
> WARN_ON(gc->cq_table[cq->queue.id]);
> gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
> --
> 2.43.0

2024-04-24 08:59:26

by Konstantin Taranov

Subject: RE: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before installing cq callbacks

> > Add a boundary check inside mana_ib_install_cq_cb to prevent index
> > overflow.
>
> How is this condition possible that we are getting an out of bound queue id
> from SOC?
>

Yes, it should not happen as the HW says the upper limit on CQ_ID,
but I think it is safer to have it to dodge bugs/faulty HW.
Better safe than sorry.
You can see the same check all over the mana.ko module.


> >
> > Fixes: 2a31c5a7e0d8 ("RDMA/mana_ib: Introduce mana_ib_install_cq_cb
> > helper function")
> > Signed-off-by: Konstantin Taranov <[email protected]>
> > ---
> > drivers/infiniband/hw/mana/cq.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/infiniband/hw/mana/cq.c
> > b/drivers/infiniband/hw/mana/cq.c index 6c3bb8c..8323085 100644
> > --- a/drivers/infiniband/hw/mana/cq.c
> > +++ b/drivers/infiniband/hw/mana/cq.c
> > @@ -70,6 +70,8 @@ int mana_ib_install_cq_cb(struct mana_ib_dev
> *mdev,
> > struct mana_ib_cq *cq)
> > struct gdma_context *gc = mdev_to_gc(mdev);
> > struct gdma_queue *gdma_cq;
> >
> > + if (cq->queue.id >= gc->max_num_cqs)
> > + return -EINVAL;
> > /* Create CQ table entry */
> > WARN_ON(gc->cq_table[cq->queue.id]);
> > gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
> > --
> > 2.43.0

2024-04-25 20:37:42

by Long Li

Subject: RE: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before installing cq callbacks

> Subject: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before
> installing cq callbacks
>
> From: Konstantin Taranov <[email protected]>
>
> Add a boundary check inside mana_ib_install_cq_cb to prevent index overflow.
>
> Fixes: 2a31c5a7e0d8 ("RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper
> function")
> Signed-off-by: Konstantin Taranov <[email protected]>

Reviewed-by: Long Li <[email protected]>

> ---
> drivers/infiniband/hw/mana/cq.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
> index 6c3bb8c..8323085 100644
> --- a/drivers/infiniband/hw/mana/cq.c
> +++ b/drivers/infiniband/hw/mana/cq.c
> @@ -70,6 +70,8 @@ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev,
> struct mana_ib_cq *cq)
> struct gdma_context *gc = mdev_to_gc(mdev);
> struct gdma_queue *gdma_cq;
>
> + if (cq->queue.id >= gc->max_num_cqs)
> + return -EINVAL;
> /* Create CQ table entry */
> WARN_ON(gc->cq_table[cq->queue.id]);
> gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
> --
> 2.43.0