Re: [PATCH V1 rdma-next 22/24] RDMA/mlx5: Clamp log_max_* shifts in query_device and ucontext paths

[sashiko-bot@kernel.org]

> The device, port and ucontext attributes and the SRQ size limit are
> computed as 1 << cap from log_max_* FW capabilities. An untrusted NIC
> can report 31 or more, which makes the shift undefined. The same
> applies to 1ull << log_pg_sz with a value of 64 or more, and to the
> max_tso computed as 1 << max_lso_cap, which can be 31.
> 
> Use MLX5_CAP_GEN_LOGSZ_U32() and MLX5_CAP_GEN_LOGSZ_U64() for these
> values, and BIT() for max_tso. As the limits can now reach 2^31,
> compute max_qp_wr in 64 bits and saturate the max_res_rd_atom and
> max_total_mcast_qp_attach products at U32_MAX. Cap max_cqe at 2^30 - 1,
> the largest CQ size the create path accepts.
> 
> The SRQ size limit then lets the rounded up SRQ size overflow the int
> srq->msrq.max, and the SRQ buffer size exceed the int passed to
> create_srq_user() and create_srq_kernel(). Reject both above INT_MAX,
> computing the buffer size with check_mul_overflow().
> 
> Signed-off-by: Yishai Hadas <yishaih@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110134320.34408-1-yishaih@nvidia.com?part=22