Re: [PATCH rdma-next] RDMA/ucma: Protect kernel from QPN larger than declared in IBTA

[Leon Romanovsky <leon@kernel.org>]

On Mon, Oct 28, 2019 at 03:45:33PM +0200, Jason Gunthorpe wrote:
> On Mon, Oct 28, 2019 at 03:44:44PM +0200, Leon Romanovsky wrote:
> > From: Leon Romanovsky <leonro@mellanox.com>
> >
> > IBTA declares QPN as 24bits, mask input to ensure that kernel
> > doesn't get higher bits.
> >
> > Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
> > Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
> >  * Not fully tested yet, passed sanity tests for now.
> >  drivers/infiniband/core/ucma.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
> > index 0274e9b704be..57e68491a2fd 100644
> > +++ b/drivers/infiniband/core/ucma.c
> > @@ -1045,7 +1045,7 @@ static void ucma_copy_conn_param(struct rdma_cm_id *id,
> >  	dst->retry_count = src->retry_count;
> >  	dst->rnr_retry_count = src->rnr_retry_count;
> >  	dst->srq = src->srq;
>
> srq too?

If I read IBTA correctly, the answer is yes. In all CM messages, QPN, SRQ number and EECN are 24 bits.

Thanks

>
> Jason