Re: [PATCH rdma-next 05/13] RDMA/core: extended address handle attributes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] rdma: uverbs_copy_from() breaks forward ABI compat for zero-padded structs
--

commit 580d7ef2fa7c4af573e68362c952e7b8886ec21b
Author: Eric Davis <eric.davis@broadcom.com>

    RDMA/core: extended address handle attributes

This commit adds rdma_ah_attr_ex to carry new attributes and implements
an ioctl method to support extended address handles. It also updates
rdma_create_user_ah() to accept the initialized attributes.

> diff --git a/drivers/infiniband/core/uverbs_std_types.c b/drivers/infiniband/core/uverbs_std_types.c
> index e160786e1df16..c72c9e5a22863 100644
> --- a/drivers/infiniband/core/uverbs_std_types.c
> +++ b/drivers/infiniband/core/uverbs_std_types.c
> @@ -184,6 +184,76 @@ DECLARE_UVERBS_NAMED_OBJECT(UVERBS_OBJECT_MW,
[ ... ]
> +static int UVERBS_HANDLER(UVERBS_METHOD_AH_EX_CREATE)(
> +	struct uverbs_attr_bundle *attrs)
> +{
[ ... ]
> +	if (!(ib_dev->attrs.device_cap_flags & IB_DEVICE_RU))
> +		return -EOPNOTSUPP;
> +
> +	ret = uverbs_copy_from(&uah, attrs,
> +			       UVERBS_ATTR_CREATE_AH_EX_AH_ATTR_EX);

[Severity: Medium]
Does using uverbs_copy_from() here break forward ABI compatibility?

UVERBS_ATTR_STRUCT sets .zero_trailing = 1, which should permit a newer
userspace to pass a larger zero-padded payload to an older kernel. However,
_uverbs_copy_from() explicitly rejects larger sizes:

include/rdma/uverbs_ioctl.h:_uverbs_copy_from() {
    ...
	if (unlikely(size < attr->ptr_attr.len))
		return -EINVAL;
    ...
}

If a newer userspace application passes a zero-padded payload of 40 bytes to
this kernel (where the structure size is 36), the size check in
_uverbs_copy_from() will evaluate to 36 < 40 and return -EINVAL.

Should this use uverbs_copy_from_or_zero() instead, to properly support
trailing zeros and allow future structure extensions?

> +	if (ret)
> +		return ret;
> +
> +	ret = copy_ah_attr_from_uverbs_ah(ib_dev, &attr.ah_attr, &uah.ah_attr);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-uet-ib-core-v1-0-a0e626117113@broadcom.com?part=5