Re: [PATCH rdma-next] RDMA/ucma: Protect kernel from QPN larger than declared in IBTA

[Jason Gunthorpe <jgg@ziepe.ca>]

On Mon, Oct 28, 2019 at 03:44:44PM +0200, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@mellanox.com>
> 
> IBTA declares QPN as 24bits, mask input to ensure that kernel
> doesn't get higher bits.
> 
> Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
> Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
> ---
>  * Not fully tested yet, passed sanity tests for now.
> ---
>  drivers/infiniband/core/ucma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
> index 0274e9b704be..57e68491a2fd 100644
> --- a/drivers/infiniband/core/ucma.c
> +++ b/drivers/infiniband/core/ucma.c
> @@ -1045,7 +1045,7 @@ static void ucma_copy_conn_param(struct rdma_cm_id *id,
>  	dst->retry_count = src->retry_count;
>  	dst->rnr_retry_count = src->rnr_retry_count;
>  	dst->srq = src->srq;
> -	dst->qp_num = src->qp_num;
> +	dst->qp_num = src->qp_num & 0xFFFFFF;
>  	dst->qkey = (id->route.addr.src_addr.ss_family == AF_IB) ? src->qkey : 0;
>  }

This really needs to be squashed into the other qpn patch because what
is really being proposed here is to move the masking from the core
code to the ucma and the core code will assume that the caller is
using correct QPNS. Maybe leave behind a WARN_ON to confirm this.

Jason