[PATCH] RDMA/ucma: Allow path records to exactly fit the output buffer

[PATCH] RDMA/ucma: Allow path records to exactly fit the output buffer

[Serhat Kumral]

ucma_query_path() emits a path record only when the remaining output
buffer is strictly larger than struct ib_path_rec_data. A buffer sized
exactly for the response header and N complete records therefore gets
only N - 1 records, while resp->num_paths still advertises N. A caller
sizing its buffer for a single record gets a header claiming one path
and no path data at all.

ucma_query_ib_service() in the same file computes the record count with
a plain division and so accepts an exact fit; make ucma_query_path()
behave the same way.

Current librdmacm is unaffected because it always sizes the response for
six records while the kernel currently reports at most two paths. Other
users of the UAPI that provide an exactly sized buffer can observe the
truncated response.

Fixes: ac53b264b2f3 ("RDMA/ucma: Support querying when IB paths are not reversible")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
Reproduced with soft-RoCE (rxe) under qemu, on two 7.2.0-rc3 kernels that
differ only in this patch; the kernel config, the test program and the VM
were identical across both runs.  The test program drives
/dev/infiniband/rdma_cm directly so that hdr.out can be set to exactly

	sizeof(struct rdma_ucm_query_path_resp) +
	sizeof(struct ib_path_rec_data)		= 8 + 72 = 80

and poisons the response buffer first, so a record slot the kernel never
wrote stays recognisable afterwards.

Before:

	requesting room for 1 record(s): hdr.out = 80
	resp->num_paths (advertised by kernel) = 1
	record slot 0: UNTOUCHED (still poison)
	records that fit in the buffer and should have been copied: 1
	records actually copied:                                   0

After:

	requesting room for 1 record(s): hdr.out = 80
	resp->num_paths (advertised by kernel) = 1
	record slot 0: written by kernel   flags=0x0000002b
	records that fit in the buffer and should have been copied: 1
	records actually copied:                                   1

flags 0x2b is IB_PATH_GMP | IB_PATH_PRIMARY | IB_PATH_BIDIRECTIONAL, i.e.
exactly what ucma_query_path() writes into the record.

 drivers/infiniband/core/ucma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 878561fa1cb5..cfd202325458 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -951,7 +951,7 @@ static ssize_t ucma_query_path(struct ucma_context *ctx,
 
 	resp->num_paths = ctx->cm_id->route.num_pri_alt_paths;
 	for (i = 0, out_len -= sizeof(*resp);
-	     i < resp->num_paths && out_len > sizeof(struct ib_path_rec_data);
+	     i < resp->num_paths && out_len >= sizeof(struct ib_path_rec_data);
 	     i++, out_len -= sizeof(struct ib_path_rec_data)) {
 		struct sa_path_rec *rec = &ctx->cm_id->route.path_rec[i];
 
-- 
2.55.0