[PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ size

[PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ size

[Yonatan Nachum]

Validate the SQ ring size against the device's max LLQ size. This
ensures that when using 128-byte WQEs, userspace cannot exceed the queue
limits.

On create QP, userspace provides the SQ ring size (depth x WQE size)
which is validated against the max LLQ size.

Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Reviewed-by: Michael Margolin <mrgolin@amazon.com>
Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
---
 drivers/infiniband/hw/efa/efa_verbs.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 395290ab0584..aa1a615bb341 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -598,7 +598,8 @@ static int qp_mmap_entries_setup(struct efa_qp *qp,
 }
 
 static int efa_qp_validate_cap(struct efa_dev *dev,
-			       struct ib_qp_init_attr *init_attr)
+			       struct ib_qp_init_attr *init_attr,
+			       u32 sq_ring_size)
 {
 	if (init_attr->cap.max_send_wr > dev->dev_attr.max_sq_depth) {
 		ibdev_dbg(&dev->ibdev,
@@ -607,6 +608,14 @@ static int efa_qp_validate_cap(struct efa_dev *dev,
 			  dev->dev_attr.max_sq_depth);
 		return -EINVAL;
 	}
+
+	if (sq_ring_size > dev->dev_attr.max_llq_size) {
+		ibdev_dbg(&dev->ibdev,
+			  "qp: requested sq ring size[%u] exceeds the max[%u]\n",
+			  sq_ring_size, dev->dev_attr.max_llq_size);
+		return -EINVAL;
+	}
+
 	if (init_attr->cap.max_recv_wr > dev->dev_attr.max_rq_depth) {
 		ibdev_dbg(&dev->ibdev,
 			  "qp: requested receive wr[%u] exceeds the max[%u]\n",
@@ -676,14 +685,6 @@ int efa_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
 	ucontext = rdma_udata_to_drv_context(udata, struct efa_ucontext,
 					     ibucontext);
 
-	err = efa_qp_validate_cap(dev, init_attr);
-	if (err)
-		goto err_out;
-
-	err = efa_qp_validate_attr(dev, init_attr);
-	if (err)
-		goto err_out;
-
 	err = ib_copy_validate_udata_in_cm(udata, cmd, driver_qp_type, 0);
 	if (err)
 		goto err_out;
@@ -705,6 +706,14 @@ int efa_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
 		goto err_out;
 	}
 
+	err = efa_qp_validate_cap(dev, init_attr, cmd.sq_ring_size);
+	if (err)
+		goto err_out;
+
+	err = efa_qp_validate_attr(dev, init_attr);
+	if (err)
+		goto err_out;
+
 	create_qp_params.uarn = ucontext->uarn;
 	create_qp_params.pd = to_epd(ibqp->pd)->pdn;
 
-- 
2.50.1

Re: [PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ size

[Yonatan Nachum]

On Tue, May 26, 2026 at 08:15:36AM +0000, Yonatan Nachum wrote:
> Validate the SQ ring size against the device's max LLQ size. This
> ensures that when using 128-byte WQEs, userspace cannot exceed the queue
> limits.
> 
> On create QP, userspace provides the SQ ring size (depth x WQE size)
> which is validated against the max LLQ size.
> 
> Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> Reviewed-by: Michael Margolin <mrgolin@amazon.com>
> Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
> ---
>  drivers/infiniband/hw/efa/efa_verbs.c | 27 ++++++++++++++++++---------
>  1 file changed, 18 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
> index 395290ab0584..aa1a615bb341 100644
> --- a/drivers/infiniband/hw/efa/efa_verbs.c
> +++ b/drivers/infiniband/hw/efa/efa_verbs.c
> @@ -598,7 +598,8 @@ static int qp_mmap_entries_setup(struct efa_qp *qp,
>  }
>  
>  static int efa_qp_validate_cap(struct efa_dev *dev,
> -			       struct ib_qp_init_attr *init_attr)
> +			       struct ib_qp_init_attr *init_attr,
> +			       u32 sq_ring_size)
>  {
>  	if (init_attr->cap.max_send_wr > dev->dev_attr.max_sq_depth) {
>  		ibdev_dbg(&dev->ibdev,
> @@ -607,6 +608,14 @@ static int efa_qp_validate_cap(struct efa_dev *dev,
>  			  dev->dev_attr.max_sq_depth);
>  		return -EINVAL;
>  	}
> +
> +	if (sq_ring_size > dev->dev_attr.max_llq_size) {
> +		ibdev_dbg(&dev->ibdev,
> +			  "qp: requested sq ring size[%u] exceeds the max[%u]\n",
> +			  sq_ring_size, dev->dev_attr.max_llq_size);
> +		return -EINVAL;
> +	}
> +
>  	if (init_attr->cap.max_recv_wr > dev->dev_attr.max_rq_depth) {
>  		ibdev_dbg(&dev->ibdev,
>  			  "qp: requested receive wr[%u] exceeds the max[%u]\n",
> @@ -676,14 +685,6 @@ int efa_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
>  	ucontext = rdma_udata_to_drv_context(udata, struct efa_ucontext,
>  					     ibucontext);
>  
> -	err = efa_qp_validate_cap(dev, init_attr);
> -	if (err)
> -		goto err_out;
> -
> -	err = efa_qp_validate_attr(dev, init_attr);
> -	if (err)
> -		goto err_out;
> -
>  	err = ib_copy_validate_udata_in_cm(udata, cmd, driver_qp_type, 0);
>  	if (err)
>  		goto err_out;
> @@ -705,6 +706,14 @@ int efa_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
>  		goto err_out;
>  	}
>  
> +	err = efa_qp_validate_cap(dev, init_attr, cmd.sq_ring_size);
> +	if (err)
> +		goto err_out;
> +
> +	err = efa_qp_validate_attr(dev, init_attr);
> +	if (err)
> +		goto err_out;
> +
>  	create_qp_params.uarn = ucontext->uarn;
>  	create_qp_params.pd = to_epd(ibqp->pd)->pdn;
>  
> -- 
> 2.50.1
>

Hi, kind reminder

Thanks

Re: [PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ size

[Jason Gunthorpe]

On Tue, May 26, 2026 at 08:15:36AM +0000, Yonatan Nachum wrote:
> Validate the SQ ring size against the device's max LLQ size. This
> ensures that when using 128-byte WQEs, userspace cannot exceed the queue
> limits.
> 
> On create QP, userspace provides the SQ ring size (depth x WQE size)
> which is validated against the max LLQ size.
> 
> Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> Reviewed-by: Michael Margolin <mrgolin@amazon.com>
> Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
> ---
>  drivers/infiniband/hw/efa/efa_verbs.c | 27 ++++++++++++++++++---------
>  1 file changed, 18 insertions(+), 9 deletions(-)

The Sashiko comments look like they are worth addressing

https://sashiko.dev/#/patchset/20260517175216.614494-1-ynachum%40amazon.com

Jason

Re: [PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ sizey

[Yonatan Nachum]

On Mon, Jun 01, 2026 at 09:30:05PM -0300, Jason Gunthorpe wrote:
> On Tue, May 26, 2026 at 08:15:36AM +0000, Yonatan Nachum wrote:
> > Validate the SQ ring size against the device's max LLQ size. This
> > ensures that when using 128-byte WQEs, userspace cannot exceed the queue
> > limits.
> > 
> > On create QP, userspace provides the SQ ring size (depth x WQE size)
> > which is validated against the max LLQ size.
> > 
> > Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> > Reviewed-by: Michael Margolin <mrgolin@amazon.com>
> > Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
> > ---
> >  drivers/infiniband/hw/efa/efa_verbs.c | 27 ++++++++++++++++++---------
> >  1 file changed, 18 insertions(+), 9 deletions(-)
> 
> The Sashiko comments look like they are worth addressing
> 
> https://sashiko.dev/#/patchset/20260517175216.614494-1-ynachum%40amazon.com
> 
> Jason

Hi, thanks for the answer.
That is not the Sashiko link for the patch, its this:
https://sashiko.dev/#/patchset/20260526081536.1203553-1-ynachum%40amazon.com

I reviewed the comments and none of them is relevant for the patch.

Thanks 

Re: [PATCH for-rc] RDMA/efa: Validate SQ ring size against max LLQ sizey

[Jason Gunthorpe]

On Tue, Jun 02, 2026 at 06:51:03AM +0000, Yonatan Nachum wrote:
> On Mon, Jun 01, 2026 at 09:30:05PM -0300, Jason Gunthorpe wrote:
> > On Tue, May 26, 2026 at 08:15:36AM +0000, Yonatan Nachum wrote:
> > > Validate the SQ ring size against the device's max LLQ size. This
> > > ensures that when using 128-byte WQEs, userspace cannot exceed the queue
> > > limits.
> > > 
> > > On create QP, userspace provides the SQ ring size (depth x WQE size)
> > > which is validated against the max LLQ size.
> > > 
> > > Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> > > Reviewed-by: Michael Margolin <mrgolin@amazon.com>
> > > Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
> > > ---
> > >  drivers/infiniband/hw/efa/efa_verbs.c | 27 ++++++++++++++++++---------
> > >  1 file changed, 18 insertions(+), 9 deletions(-)
> > 
> > The Sashiko comments look like they are worth addressing
> > 
> > https://sashiko.dev/#/patchset/20260517175216.614494-1-ynachum%40amazon.com
> > 
> > Jason
> 
> Hi, thanks for the answer.
> That is not the Sashiko link for the patch, its this:
> https://sashiko.dev/#/patchset/20260526081536.1203553-1-ynachum%40amazon.com

Oh boy, it is annoying to get the right one up :\

> I reviewed the comments and none of them is relevant for the patch.

Ok, applied to for-rc

Thanks,
Jason