Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83904132 authored by Jack Morgenstein's avatar Jack Morgenstein Committed by Roland Dreier
Browse files

IB/mlx4: Sanity check userspace send queue sizes 



Add sanity checks to send queue sizes passed in from userspace. The
minimum sq stride value below is taken from the MT25408 PRM (section
11.10, Table 306, log_sq_stride definition).

Without this check, userspace can submit arbitrarily large/small
values for the number of WQEs and the stride, which can crash the
kernel.

Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent fd312561

drivers/infiniband/hw/mlx4/qp.c

+14 −2
Original line number Diff line number Diff line
@@ -63,6 +63,10 @@ struct mlx4_ib_sqp { 
	u8			header_buf[MLX4_IB_UD_HEADER_SIZE];

};



enum {

	MLX4_IB_MIN_SQ_STRIDE = 6

};



static const __be32 mlx4_ib_opcode[] = {

	[IB_WR_SEND]			= __constant_cpu_to_be32(MLX4_OPCODE_SEND),

	[IB_WR_SEND_WITH_IMM]		= __constant_cpu_to_be32(MLX4_OPCODE_SEND_IMM),
@@ -285,9 +289,17 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap, 
	return 0;

}



static int set_user_sq_size(struct mlx4_ib_qp *qp,

static int set_user_sq_size(struct mlx4_ib_dev *dev,

			    struct mlx4_ib_qp *qp,

			    struct mlx4_ib_create_qp *ucmd)

{

	/* Sanity check SQ size before proceeding */

	if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes	 ||

	    ucmd->log_sq_stride >

		ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||

	    ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)

		return -EINVAL;



	qp->sq.wqe_cnt   = 1 << ucmd->log_sq_bb_count;

	qp->sq.wqe_shift = ucmd->log_sq_stride;
@@ -330,7 +342,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd, 


		qp->sq_no_prefetch = ucmd.sq_no_prefetch;



		err = set_user_sq_size(qp, &ucmd);

		err = set_user_sq_size(dev, qp, &ucmd);

		if (err)

			goto err;