Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e89a194 authored by David Dillow's avatar David Dillow Committed by Roland Dreier
Browse files

IB/srp: Enforce protocol limit on srp_sg_tablesize 



The current SRP initiator will allow unlimited s/g entries in the
indirect descriptors lists, but the entry count field in the SRP_CMD
request is 8 bits, so setting srp_sg_tablesize too large will open the
possibility of wrapping the count and generating invalid requests.

Clamp srp_sg_tablesize to the protocol limits to prevent surprises.

Reported by Martin W. Schlining III <mschlining@datadirectnet.com>.

Signed-off-by: default avatarDavid Dillow <dillowda@ornl.gov>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 826d8010

drivers/infiniband/ulp/srp/ib_srp.c

+6 −1
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ static int srp_max_iu_len; 


module_param(srp_sg_tablesize, int, 0444);

MODULE_PARM_DESC(srp_sg_tablesize,

		 "Max number of gather/scatter entries per I/O (default is 12)");

		 "Max number of gather/scatter entries per I/O (default is 12, max 255)");



static int topspin_workarounds = 1;
@@ -2138,6 +2138,11 @@ static int __init srp_init_module(void) 
{

	int ret;



	if (srp_sg_tablesize > 255) {

		printk(KERN_WARNING PFX "Clamping srp_sg_tablesize to 255\n");

		srp_sg_tablesize = 255;

	}



	ib_srp_transport_template =

		srp_attach_transport(&ib_srp_transport_functions);

	if (!ib_srp_transport_template)