Re: [PATCH for-rc v3 5/8] RDMA/bnxt_re: Validate num_sge in bnxt_re_post_srq_recv()

[Leon Romanovsky <leon@kernel.org>]

On Tue, Sep 22, 2026 at 10:09:52AM +0530, Selvin Xavier wrote:
> On Tue, Sep 22, 2026 at 6:37 AM <sashiko-bot@kernel.org> wrote:
> >
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [High] rdma/bnxt_re: un-ratelimited error log in spinlock allows DoS
> > --
> >
> > commit bb7479cd7b3a22e9b0e6b2862ab2b9133790528b
> > Author: Selvin Xavier <selvin.xavier@broadcom.com>
> >
> > RDMA/bnxt_re: Validate num_sge in bnxt_re_post_srq_recv()
> >
> > Add a check if max sge for SRQ is exceeding the device maximum.
> >
> > > diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > index c35ed6ed03516..3cccef8e2e837 100644
> > > --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > @@ -2399,6 +2399,13 @@ int bnxt_re_post_srq_recv(struct ib_srq *ib_srq, const struct ib_recv_wr *wr,
> > >               /* Transcribe each ib_recv_wr to qplib_swqe */
> > >               wqe.flags = 0;
> > >               wqe.num_sge = wr->num_sge;
> > > +             if (wr->num_sge > srq->qplib_srq.max_sge) {
> > > +                     ibdev_err(&srq->rdev->ibdev,
> > > +                               "Limit exceeded for SRQ Receive SGEs");
> >
> > [Severity: High]
> > Is it safe to use an un-ratelimited ibdev_err() here while holding the
> > srq->lock spinlock with interrupts disabled in bnxt_re_post_srq_recv()?
> >
> > Since an unprivileged user can repeatedly invoke the RDMA uverbs API with a
> > wr->num_sge larger than srq->qplib_srq.max_sge, could this regression allow a
> > local user to flood the kernel log buffer and potentially cause soft lockups?
>  It is possible to reach the kernel driver using an under privilaged
> user, but there is no support in rdma-core/libbnxt_re to call
> ibv_cmd_post_srq_recv and this code path will not be reached as of
> now. So I think this can be ignored.

We cannot assume that rdma-core is trusted. Anyone can build it locally and use it
to interact with the kernel. In addition, syzkaller uses our UAPI structures
and commands directly, without involving rdma-core.

Thanks

> >
> > > +                     rc = -EINVAL;
> > > +                     *bad_wr = wr;
> > > +                     break;
> > > +             }
> > >               bnxt_re_build_sgl(wr->sg_list, wqe.sg_list, wr->num_sge);
> > >               wqe.wr_id = wr->wr_id;
> > >               wqe.type = BNXT_QPLIB_SWQE_TYPE_RECV;
> >
> > --
> > Sashiko AI review · https://sashiko.dev/#/patchset/20260922061230.7909-1-selvin.xavier@broadcom.com?part=5