From: Leon Romanovsky <leon@kernel.org>
To: listdansp <listdansp@mail.ru>
Cc: dledford@redhat.com, jgg@ziepe.ca, linux-rdma@vger.kernel.org
Subject: Re: mlx5 attr.max_sge checks
Date: Wed, 20 Dec 2023 10:07:29 +0200 [thread overview]
Message-ID: <20231220080729.GB136797@unreal> (raw)
In-Reply-To: <c78ab477-5b54-82b5-1d5f-8b0022195f78@mail.ru>
On Tue, Dec 19, 2023 at 09:56:01PM +0300, listdansp wrote:
> Hi,
>
> While investigating the one report of the static analyzer (svacer), it was
> discovered that attr.max_sge was not checked for the maximum value in the
> mlx5_ib_create_srq function. However, this check is present in
> https://github.com/linux-rdma/rdma-core. Also, checks are present in most
> other infiniband Linux Kernel drivers. This may lead to incorrect driver
> operation for example
> int mlx5_ib_read_wqe_srq(struct mlx5_ib_srq *srq, int wqe_index, void
> *buffer, size_tbuflen, size_t*bc)
> {
> structib_umem*umem= srq->umem;
> size_twqe_size= 1 << srq->msrq.wqe_shift; // integeroverflowhere
> if(buflen< wqe_size)
> return-EINVAL;
> In my opinion, the only possible solution to this problem may be to add a
> check to mlx5_ib_create_srq similar to
> https://github.com/linux-rdma/rdma-core
> <https://github.com/linux-rdma/rdma-core> like
> u32 max_sge= MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq) /
> sizeof(structmlx5_wqe_data_seg);
> if (attr->attr.max_sge > max_sge) {
> mlx5_ib_dbg
> <https://elixir.bootlin.com/linux/v5.10.169/C/ident/mlx5_ib_dbg>(dev,
> "max_sge%d, cap %d\n", init_attr
> <https://elixir.bootlin.com/linux/v5.10.169/C/ident/init_attr>->attr.max_
> <https://elixir.bootlin.com/linux/v5.10.169/C/ident/max_wr>sge, max_sge);
> return -EINVAL <https://elixir.bootlin.com/linux/v5.10.169/C/ident/EINVAL>;
> }
>
> I would appreciate your suggestions and comments.
Can you please provide an example of such values?
At least in the presented case, the values are supplied by FW and are
supposed to be right without any overflows.
Thanks
>
> Best regards,
> Danila
>
>
next parent reply other threads:[~2023-12-20 8:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <c78ab477-5b54-82b5-1d5f-8b0022195f78@mail.ru>
2023-12-20 8:07 ` Leon Romanovsky [this message]
2024-03-14 20:29 ` mlx5 attr.max_sge checks listdansp
2024-03-17 8:35 ` Leon Romanovsky
2024-04-03 12:28 ` listdansp
2024-05-05 8:58 ` Patrisious Haddad
[not found] <1703013183-24379-mlmmj-3a1ea6ac@vger.kernel.org>
2023-12-19 19:39 ` listdansp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231220080729.GB136797@unreal \
--to=leon@kernel.org \
--cc=dledford@redhat.com \
--cc=jgg@ziepe.ca \
--cc=linux-rdma@vger.kernel.org \
--cc=listdansp@mail.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).