Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
In-Reply-To: <20210226075515.21371-1-dinghao.liu@zju.edu.cn>
From:   "Bernard Metzler" <BMT@zurich.ibm.com>
To:     "Dinghao Liu" <dinghao.liu@zju.edu.cn>
Cc:     "kjlu" <kjlu@umn.edu>, "Doug Ledford" <dledford@redhat.com>,
        "Jason Gunthorpe" <jgg@ziepe.ca>,
        "linux-rdma" <linux-rdma@vger.kernel.org>,
        "linux-kernel" <linux-kernel@vger.kernel.org>
Date:   Fri, 26 Feb 2021 09:17:07 +0000
MIME-Version: 1.0
Sensitivity: 
Importance: Normal
References: <20210226075515.21371-1-dinghao.liu@zju.edu.cn>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Message-Id: <OF56E5E5C1.78489712-ON00258688.0032E2EA-00258688.003301A1@notes.na.collabserv.com>
Subject: Re:  [PATCH] RDMA/siw: Fix missing check in siw_get_hdr
Precedence: bulk

-----"Dinghao Liu" <dinghao.liu@zju.edu.cn> wrote: -----

>To: dinghao.liu@zju.edu.cn, kjlu@umn.edu
>From: "Dinghao Liu" <dinghao.liu@zju.edu.cn>
>Date: 02/26/2021 08:56AM
>Cc: "Bernard Metzler" <bmt@zurich.ibm.com>, "Doug Ledford"
><dledford@redhat.com>, "Jason Gunthorpe" <jgg@ziepe.ca>,
>linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
>Subject: [EXTERNAL] [PATCH] RDMA/siw: Fix missing check in
>siw=5Fget=5Fhdr
>
>We should also check the range of opcode after calling
>=5F=5Frdmap=5Fget=5Fopcode() in the else branch to prevent potential
>overflow.

Hi Dinghao,
No this is not needed. We always first read the minimum
header information (MPA len, DDP flags, RDMAP opcode,
STag, target offset). Only if we have received that
into local buffer, we check for the opcode this one time.
Now the opcode determines the remaining length of the
variably sized part of the header to be received.

We do not have to check the opcode again, since we
already received and checked it.

Best,
Bernard.

>
>Fixes: 8b6a361b8c482 ("rdma/siw: receive path")
>Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
>---
> drivers/infiniband/sw/siw/siw=5Fqp=5Frx.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
>diff --git a/drivers/infiniband/sw/siw/siw=5Fqp=5Frx.c
>b/drivers/infiniband/sw/siw/siw=5Fqp=5Frx.c
>index 60116f20653c..301e7fe2c61a 100644
>--- a/drivers/infiniband/sw/siw/siw=5Fqp=5Frx.c
>+++ b/drivers/infiniband/sw/siw/siw=5Fqp=5Frx.c
>@@ -1072,6 +1072,16 @@ static int siw=5Fget=5Fhdr(struct siw=5Frx=5Fstream
>*srx)
> 		siw=5Fdbg=5Fqp(rx=5Fqp(srx), "new header, opcode %u\n", opcode);
> 	} else {
> 		opcode =3D =5F=5Frdmap=5Fget=5Fopcode(c=5Fhdr);
>+
>+		if (opcode > RDMAP=5FTERMINATE) {
>+			pr=5Fwarn("siw: received unknown packet type %u\n",
>+				opcode);
>+
>+			siw=5Finit=5Fterminate(rx=5Fqp(srx), TERM=5FERROR=5FLAYER=5FRDMAP,
>+					   RDMAP=5FETYPE=5FREMOTE=5FOPERATION,
>+					   RDMAP=5FECODE=5FOPCODE, 0);
>+			return -EINVAL;
>+		}
> 	}
> 	set=5Frx=5Ffpdu=5Fcontext(qp, opcode);
> 	frx =3D qp->rx=5Ffpdu;
>--=20
>2.17.1
>
>