Re: [PATCH rdma-next 06/10] RDMA/mana_ib: Post send and memory-management WRs on RC QPs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/mana_ib: WQE ring buffer overwrite due to missing SQ SGE bounds check
--

commit 7f1f7264400f5f00c6c885de8b54ac6900f87a1f
Author: Konstantin Taranov <kotaranov@microsoft.com>

RDMA/mana_ib: Post send and memory-management WRs on RC QPs

This commit implements send work request posting for RC QPs in the mana_ib
driver. It posts communication work requests to the send queue and memory
work requests to the memory management queue.

> diff --git a/drivers/infiniband/hw/mana/wr.c b/drivers/infiniband/hw/mana/wr.c
> index 5d42af91fce4a..6cc67537c6557 100644
> --- a/drivers/infiniband/hw/mana/wr.c
> +++ b/drivers/infiniband/hw/mana/wr.c
[ ... ]
> @@ -224,6 +289,287 @@ static int mana_ib_post_send_ud(struct mana_ib_qp *qp, const struct ib_send_wr *
>  	return err;
>  }
>  
> +static int mana_ib_post_sq(struct mana_ib_qp *qp, const struct ib_send_wr *wr)
> +{
> +	struct gdma_queue *sq = qp->rc_qp.queues[MANA_RC_SEND_QUEUE_REQUESTER].kmem;
[ ... ]
> +	int err, i;
> +
> +	if (shadow_queue_full(&qp->shadow_sq))
> +		return -ENOMEM;
> +
> +	if (wr->num_sge > MAX_TX_WQE_SGL_ENTRIES)
> +		return -EINVAL;

[Severity: High]
Does this bounds check in mana_ib_post_sq() allow out-of-bounds memory writes
if a kernel RDMA client provides a wr->num_sge that is larger than the QP's
negotiated maximum capacity?

Other RDMA core providers typically validate num_sge against the QP's specific
limits because clients can misuse the API.

[ ... ]
> +	wqe_req.inline_oob_size = INLINE_OOB_EXTRA_LARGE_SIZE;
> +	wqe_req.inline_oob_data = &send_oob;
> +	wqe_req.client_data_unit = ib_mtu_enum_to_int(qp->mtu);
> +	wqe_req.flags |= GDMA_WR_GENERATION_1;
> +	wqe_req.wqe_size_in_bu = qp->rc_qp.wqe_size_in_bu;

Because the WQE size is explicitly fixed to the QP's configured size here, if
wr->num_sge is larger than the QP's negotiated capacity but still less than or
equal to MAX_TX_WQE_SGL_ENTRIES, mana_gd_post_work_request() will use
wqe_size_in_bu to calculate the ring buffer slot size.

Meanwhile, mana_gd_write_ib_sgl() will write the full wr->num_sge entries into
the queue. This can overwrite the adjacent WQE in the ring buffer, leading to
hardware memory corruption.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001182015.1757203-1-kotaranov@linux.microsoft.com?part=6