mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH v5 0/3] RDMA/srpt: fix the descriptor table checks and the context counters
@ 2026-10-25  1:37 Yehyeong Lee
  2026-10-25  1:37 ` [PATCH v5 1/3] RDMA/srpt: bound the indirect descriptor table to the IU Yehyeong Lee
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Yehyeong Lee @ 2026-10-25  1:37 UTC (permalink / raw)
  To: Bart Van Assche
  Cc: Leon Romanovsky, Jason Gunthorpe, linux-rdma, target-devel,
	linux-kernel, stable, yhlee

The first two patches bound initiator supplied descriptor data, and the
third widens the counters that hold what the first one admits.

A 510 entry table fits in the default 8276 byte IU when the additional CDB
is empty, so the bound accepts it and the counters then have to hold it.
With only the bound, a conforming command carrying 256 or more descriptors
still wraps n_rw_ctx and leaks every context it allocated. With only the
wider counters, a command that sets ADDITIONAL CDB LENGTH to its maximum
still walks a descriptor table that runs past the receive buffer.

The first fix dates from the driver's merge and the other two from the
conversion to the generic RDMA READ/WRITE API, which is why they are split.

Changes since v4, all in 1/3 and all from Bart's review.

The span check now uses struct_size(idb, desc_list, nbufs) rather than an
open-coded sizeof and multiplication, and the size_t casts are gone. nbufs
is at most 510 by the time the span is computed, because the existing count
check runs first, so struct_size() cannot saturate.

nbufs == 0 is refused explicitly. Bart and Sashiko both pointed out that a
table_desc.len below one descriptor still got through while the v4 commit
message claimed otherwise, so the check is there now and the message
describes what the code does.

2/3 is new, and it has not been reviewed yet. While working out why
nbufs == 0 reaches ib_post_send() I read the rest of srpt_alloc_rw_ctxs()
and found that a descriptor length of zero is not checked either. It
reaches target_alloc_sgl(), which has no length check of its own, and ends
in sg_init_marker() indexing a zero entry table at nents - 1, which is
unsigned, so the write lands far outside any allocation. DIRECT requests
are affected as well as INDIRECT tables, so the check sits in the shared
loop, and the patch carries its own Fixes tag.

3/3 is unchanged and carries Bart's Reviewed-by.

Link: https://lore.kernel.org/linux-rdma/20261024162852.3528224-1-yhlee@isslab.korea.ac.kr

Yehyeong Lee (3):
  RDMA/srpt: bound the indirect descriptor table to the IU
  RDMA/srpt: reject zero-length buffer descriptors
  RDMA/srpt: widen the indirect RDMA context counters

 drivers/infiniband/ulp/srpt/ib_srpt.c | 21 ++++++++++++++++++++-
 drivers/infiniband/ulp/srpt/ib_srpt.h |  4 ++--
 2 files changed, 22 insertions(+), 3 deletions(-)


base-commit: 6fba331225f5040e93d0947d1027e9712238291f
-- 
2.43.0


^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-25 14:25 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-25  1:37 [PATCH v5 0/3] RDMA/srpt: fix the descriptor table checks and the context counters Yehyeong Lee
2026-10-25  1:37 ` [PATCH v5 1/3] RDMA/srpt: bound the indirect descriptor table to the IU Yehyeong Lee
2026-10-25  1:37 ` [PATCH v5 2/3] RDMA/srpt: reject zero-length buffer descriptors Yehyeong Lee
2026-10-25  1:37 ` [PATCH v5 3/3] RDMA/srpt: widen the indirect RDMA context counters Yehyeong Lee
2026-10-25 14:25 ` [PATCH v5 0/3] RDMA/srpt: fix the descriptor table checks and the " Bart Van Assche

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®