Re: [PATCH v3 2/2] RDMA/srpt: widen the indirect RDMA context counters

[sashiko-bot@kernel.org]

> srpt_send_ioctx::n_rdma and ::n_rw_ctx are u8, and neither of the values
> stored in them is bounded by 255.
> 
> n_rw_ctx counts the INDIRECT descriptors a command carries, and the count
> guard in srpt_get_desc_tbl() admits data_out_desc_cnt plus
> data_in_desc_cnt, so up to 510. At 256 descriptors n_rw_ctx wraps to
> zero, and srpt_release_cmd() frees the contexts only when it is non-zero,
> so every scatterlist and RDMA context the command allocated leaks.
> 
> n_rdma is not a descriptor count at all. It is the sum of the
> rdma_rw_ctx_init() return values, which is the number of work requests
> each context needs, accumulated by ioctx->n_rdma += ret. A handful of
> descriptors for large transfers can pass 255 on their own, with no
> unusual descriptor count involved. A wrapped n_rdma is then handed to
> atomic_sub_return(ioctx->n_rdma, &ch->sq_wr_avail) and tested by
> WARN_ON(ioctx->n_rdma <= 0), so the send queue work request accounting
> drifts too.
> 
> Make both counters int, the type the values they accumulate already have.
> 
> Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022143901.2991062-1-yhlee@isslab.korea.ac.kr?part=2