Re: [PATCH for-rc v3 3/8] RDMA/bnxt_re: Validate SRQ max_sge at create time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bnxt_re: format string mismatch prints u32 as signed
--

commit c1caa6b4fbeb062c8f585d11a5ad5310dce0f434
Author: Selvin Xavier <selvin.xavier@broadcom.com>

RDMA/bnxt_re: Validate SRQ max_sge at create time
    
bnxt_re_create_srq() stored attr.max_sge into srq->qplib_srq.max_sge
unvalidated, which defeats the num_sge check in
bnxt_re_post_srq_recv() since that check compares against this same
attacker-chosen value. Reject max_sge > dev_attr->max_srq_sges at
create time, and clamp dev_attr->max_srq_sges to BNXT_STATIC_MAX_SGE
since SRQ WQEs use the fixed-size SGE array.

> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index 081230fcb059e..911ac780c89bb 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -2236,6 +2236,14 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
>  		goto exit;
>  	}
>  
> +	if (srq_init_attr->attr.max_sge > dev_attr->max_srq_sges) {
> +		ibdev_err(&rdev->ibdev,
> +			  "Create SRQ failed - max_sge %d exceeds supported %d",
> +			  srq_init_attr->attr.max_sge, dev_attr->max_srq_sges);

[Severity: Low]
Will this print confusing error logs when an invalid size is passed?

Since both srq_init_attr->attr.max_sge and dev_attr->max_srq_sges are u32,
the %d format specifier will interpret them as signed integers. This means
large invalid values (like those >= 0x80000000) will be logged as negative
numbers rather than their actual unsigned magnitude. Should these be printed
with %u instead?

> +		rc = -EINVAL;
> +		goto exit;
> +	}
> +
>  	if (srq_init_attr->srq_type != IB_SRQT_BASIC) {
>  		rc = -EOPNOTSUPP;
>  		goto exit;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922061230.7909-1-selvin.xavier@broadcom.com?part=3