* [PATCH] RDMA/rtrs-clt: Reject invalid queue_depth from the peer
@ 2026-09-23 4:09 ` Quanye Yang
0 siblings, 0 replies; 5+ messages in thread
From: Quanye Yang @ 2026-09-23 4:09 UTC (permalink / raw)
To: Md. Haris Iqbal, Jack Wang, Jason Gunthorpe, Leon Romanovsky,
Danil Kipnis
Cc: Jack Wang, linux-rdma, linux-kernel, Farhad Alemi
queue_depth is taken from the server's CM private_data and later
used as a session invariant. A peer can send 0, which the client
stores and then trips WARN_ON() in create_con_cq_qp() when the
next connection is set up.
Reject a zero queue_depth on ESTABLISHED, same as a bad
magic or version, and fail the handshake with -ECONNRESET.
Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Link: https://lore.kernel.org/linux-rdma/CA+0ovCg_sG8gaZXXj9zmOrpxRt=8+-x9wvycVNUKwWmMbr6-Yg@mail.gmail.com
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index eac38b57b00d..7fbbb9a53607 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -1853,6 +1853,10 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con,
}
if (con->c.cid == 0) {
queue_depth = le16_to_cpu(msg->queue_depth);
+ if (!queue_depth) {
+ rtrs_err(clt, "Invalid queue depth %u\n", queue_depth);
+ return -ECONNRESET;
+ }
if (clt_path->queue_depth > 0 && queue_depth != clt_path->queue_depth) {
rtrs_err(clt, "Error: queue depth changed\n");
---
base-commit: 93f51579e7df248780214094418f205253383cc5
change-id: 20260922-rtrs-fix-warning-rtrs-clt-rdma-cm-handler-2160ee358b4e
Best regards,
--
Quanye Yang <quanyeyang@proton.me>
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] RDMA/rtrs-clt: Reject invalid queue_depth from the peer
2026-09-23 4:09 ` Quanye Yang
(?)
@ 2026-09-23 4:20 ` sashiko-bot
-1 siblings, 0 replies; 5+ messages in thread
From: sashiko-bot @ 2026-09-23 4:20 UTC (permalink / raw)
To: Quanye Yang; +Cc: linux-rdma
> From: Quanye Yang <quanyeyang@proton.me>
>
> queue_depth is taken from the server's CM private_data and later
> used as a session invariant. A peer can send 0, which the client
> stores and then trips WARN_ON() in create_con_cq_qp() when the
> next connection is set up.
>
> Reject a zero queue_depth on ESTABLISHED, same as a bad
> magic or version, and fail the handshake with -ECONNRESET.
>
> Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Link: https://lore.kernel.org/linux-rdma/CA+0ovCg_sG8gaZXXj9zmOrpxRt=8+-x9wvycVNUKwWmMbr6-Yg@mail.gmail.com
> Signed-off-by: Quanye Yang <quanyeyang@proton.me>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260922-rtrs-fix-warning-rtrs-clt-rdma-cm-handler-v1-1-2076c0ee1455@proton.me?part=1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] RDMA/rtrs-clt: Reject invalid queue_depth from the peer
2026-09-23 4:09 ` Quanye Yang
(?)
(?)
@ 2026-09-23 13:31 ` Jinpu Wang
-1 siblings, 0 replies; 5+ messages in thread
From: Jinpu Wang @ 2026-09-23 13:31 UTC (permalink / raw)
To: quanyeyang
Cc: Md. Haris Iqbal, Jason Gunthorpe, Leon Romanovsky, Danil Kipnis,
linux-rdma, linux-kernel, Farhad Alemi
On Wed, Sep 23, 2026 at 6:10 AM Quanye Yang via B4 Relay
<devnull+quanyeyang.proton.me@kernel.org> wrote:
>
> From: Quanye Yang <quanyeyang@proton.me>
>
> queue_depth is taken from the server's CM private_data and later
> used as a session invariant. A peer can send 0, which the client
> stores and then trips WARN_ON() in create_con_cq_qp() when the
> next connection is set up.
>
> Reject a zero queue_depth on ESTABLISHED, same as a bad
> magic or version, and fail the handshake with -ECONNRESET.
>
> Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Link: https://lore.kernel.org/linux-rdma/CA+0ovCg_sG8gaZXXj9zmOrpxRt=8+-x9wvycVNUKwWmMbr6-Yg@mail.gmail.com
> Signed-off-by: Quanye Yang <quanyeyang@proton.me>
lgtm, thx!
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
> ---
> drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> index eac38b57b00d..7fbbb9a53607 100644
> --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> @@ -1853,6 +1853,10 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con,
> }
> if (con->c.cid == 0) {
> queue_depth = le16_to_cpu(msg->queue_depth);
> + if (!queue_depth) {
> + rtrs_err(clt, "Invalid queue depth %u\n", queue_depth);
> + return -ECONNRESET;
> + }
>
> if (clt_path->queue_depth > 0 && queue_depth != clt_path->queue_depth) {
> rtrs_err(clt, "Error: queue depth changed\n");
>
> ---
> base-commit: 93f51579e7df248780214094418f205253383cc5
> change-id: 20260922-rtrs-fix-warning-rtrs-clt-rdma-cm-handler-2160ee358b4e
>
> Best regards,
> --
> Quanye Yang <quanyeyang@proton.me>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] RDMA/rtrs-clt: Reject invalid queue_depth from the peer
2026-09-23 4:09 ` Quanye Yang
` (2 preceding siblings ...)
(?)
@ 2026-09-29 18:24 ` Leon Romanovsky
-1 siblings, 0 replies; 5+ messages in thread
From: Leon Romanovsky @ 2026-09-29 18:24 UTC (permalink / raw)
To: Md. Haris Iqbal, Jack Wang, Jason Gunthorpe, Danil Kipnis,
Quanye Yang
Cc: Jack Wang, linux-rdma, linux-kernel, Farhad Alemi
On Tue, 22 Sep 2026 21:09:58 -0700, Quanye Yang wrote:
> queue_depth is taken from the server's CM private_data and later
> used as a session invariant. A peer can send 0, which the client
> stores and then trips WARN_ON() in create_con_cq_qp() when the
> next connection is set up.
>
> Reject a zero queue_depth on ESTABLISHED, same as a bad
> magic or version, and fail the handshake with -ECONNRESET.
>
> [...]
Applied, thanks!
[1/1] RDMA/rtrs-clt: Reject invalid queue_depth from the peer
https://git.kernel.org/rdma/rdma/c/724cd362162ca7
Best regards,
--
Leon Romanovsky <leon@kernel.org>
^ permalink raw reply [flat|nested] 5+ messages in thread