Re: [PATCH for-rc v3 5/8] RDMA/bnxt_re: Validate num_sge in bnxt_re_post_srq_recv()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/bnxt_re: un-ratelimited error log in spinlock allows DoS
--

commit bb7479cd7b3a22e9b0e6b2862ab2b9133790528b
Author: Selvin Xavier <selvin.xavier@broadcom.com>

RDMA/bnxt_re: Validate num_sge in bnxt_re_post_srq_recv()

Add a check if max sge for SRQ is exceeding the device maximum.

> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index c35ed6ed03516..3cccef8e2e837 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -2399,6 +2399,13 @@ int bnxt_re_post_srq_recv(struct ib_srq *ib_srq, const struct ib_recv_wr *wr,
>  		/* Transcribe each ib_recv_wr to qplib_swqe */
>  		wqe.flags = 0;
>  		wqe.num_sge = wr->num_sge;
> +		if (wr->num_sge > srq->qplib_srq.max_sge) {
> +			ibdev_err(&srq->rdev->ibdev,
> +				  "Limit exceeded for SRQ Receive SGEs");

[Severity: High]
Is it safe to use an un-ratelimited ibdev_err() here while holding the
srq->lock spinlock with interrupts disabled in bnxt_re_post_srq_recv()?

Since an unprivileged user can repeatedly invoke the RDMA uverbs API with a
wr->num_sge larger than srq->qplib_srq.max_sge, could this regression allow a
local user to flood the kernel log buffer and potentially cause soft lockups?

> +			rc = -EINVAL;
> +			*bad_wr = wr;
> +			break;
> +		}
>  		bnxt_re_build_sgl(wr->sg_list, wqe.sg_list, wr->num_sge);
>  		wqe.wr_id = wr->wr_id;
>  		wqe.type = BNXT_QPLIB_SWQE_TYPE_RECV;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922061230.7909-1-selvin.xavier@broadcom.com?part=5