Re: [PATCH V1 rdma-next 13/24] RDMA/mlx5: Verify UMR CQ polling against a hostile NIC

[sashiko-bot@kernel.org]

> The generic poll path trusts the CQE content: its opcode, QPN and
> wqe_counter decide which request is completed and which waiter is woken.
> A forged CQE can therefore complete a request the driver never posted,
> or one that already completed. The driver then writes through a context
> it no longer owns, which corrupts memory, as the context is usually on
> the waiter's stack.
> 
> In adversarial mode, install a dedicated poll_one for the UMR CQ that
> does not take the CQE's word for it. The driver keeps a shadow FIFO of
> its posted requests, and a CQE is accepted only if its opcode and QPN
> match the UMR QP and its full wqe_counter matches the oldest pending
> request, one already passed to the doorbell. The context is then taken
> from the FIFO, never from the CQE. This cannot prove that the NIC
> really executed the request, as it can always report the oldest one as
> completed; it ensures that the driver completes only a context it owns,
> [ ... ]
> On teardown, stop polling the CQ before destroying the UMR QP, so a CQE
> for the destroyed QP, or for a reused QPN, is never completed to a
> waiter.
> 
> Signed-off-by: Yishai Hadas <yishaih@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110134320.34408-1-yishaih@nvidia.com?part=13