Re: [PATCH 06/10] RDMA/bnxt_re: Add compatibility checks to the uapi path

Zhu Yanjun
2026-02-08T19:29:18Z

在 2026/2/5 17:45, Jason Gunthorpe 写道:
> Check that the driver data is properly sized and properly zeroed by
> calling ib_copy_validate_udata_in().
>
> Use git history to find the commit introducing each req struct and use
> that to select the end member.
>
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>

Zhu Yanjun

> ---
> drivers/infiniband/hw/bnxt_re/ib_verbs.c | 29 +++++++++++++-----------
> 1 file changed, 16 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index f19b55c13d5809..2942ff44f6a547 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -1655,9 +1655,11 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
> qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
>
> uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
> - if (udata)
> - if (ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq))))
> - return -EFAULT;
> + if (udata) {
> + rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
> + if (rc)
> + return rc;
> + }
>
> rc = bnxt_re_test_qp_limits(rdev, qp_init_attr, dev_attr);
> if (!rc) {
> @@ -1847,9 +1849,11 @@ static int bnxt_re_init_user_srq(struct bnxt_re_dev *rdev,
> int bytes = 0;
> struct bnxt_re_ucontext *cntx = rdma_udata_to_drv_context(
> udata, struct bnxt_re_ucontext, ib_uctx);
> + int rc;
>
> - if (ib_copy_from_udata(&ureq, udata, sizeof(ureq)))
> - return -EFAULT;
> + rc = ib_copy_validate_udata_in(udata, ureq, srq_handle);
> + if (rc)
> + return rc;
>
> bytes = (qplib_srq->max_wqe * qplib_srq->wqe_size);
> bytes = PAGE_ALIGN(bytes);
> @@ -3156,10 +3160,10 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
> cq->qplib_cq.sg_info.pgshft = PAGE_SHIFT;
> if (udata) {
> struct bnxt_re_cq_req req;
> - if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> - rc = -EFAULT;
> +
> + rc = ib_copy_validate_udata_in(udata, req, cq_handle);
> + if (rc)
> goto fail;
> - }
>
> cq->umem = ib_umem_get(&rdev->ibdev, req.cq_va,
> entries * sizeof(struct cq_base),
> @@ -3289,10 +3293,9 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
> entries = dev_attr->max_cq_wqes + 1;
>
> /* uverbs consumer */
> - if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> - rc = -EFAULT;
> + rc = ib_copy_validate_udata_in(udata, req, cq_va);
> + if (rc)
> goto fail;
> - }
>
> cq->resize_umem = ib_umem_get(&rdev->ibdev, req.cq_va,
> entries * sizeof(struct cq_base),
> @@ -4391,8 +4394,8 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
> if (_is_host_msn_table(rdev->qplib_res.dattr->dev_cap_flags2))
> resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;
>
> - if (udata->inlen >= sizeof(ureq)) {
> - rc = ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq)));
> + if (udata->inlen) {
> + rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
> if (rc)
> goto cfail;
> if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {