[PATCH v4] RDMA/srpt: Reject an srp_sq_size that does not fit in a CQ

[PATCH v4] RDMA/srpt: Reject an srp_sq_size that does not fit in a CQ

[Serhat Kumral]

srpt_create_ch_ib() asks ib_cq_pool_get() for rq_size + srp_sq_size
CQ entries, but srp_sq_size is only checked against MAX_SRPT_SRQ_SIZE
(65535), never against the device's max_cqe. On a device with a
smaller limit, such as rxe (32767), ib_cq_pool_get() keeps allocating
CQs that can never satisfy the request until memory runs out:

      Out of memory and no killable processes...
      Kernel panic - not syncing: System is deadlocked on memory
      Workqueue: ib_cm cm_work_handler
      Call Trace:
       __vmalloc_node_range_noprof
       vmalloc_user_noprof
       rxe_queue_init
       rxe_cq_from_init
       rxe_create_cq
       __ib_alloc_cq
       ib_cq_pool_get
       srpt_cm_req_recv.cold

Reject such values when srp_sq_size is written.

Fixes: c804af2c1d31 ("IB/srpt: use new shared CQ mechanism")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
 drivers/infiniband/ulp/srpt/ib_srpt.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7197d95f2216..1761345b33f1 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -3603,6 +3603,8 @@ static ssize_t srpt_tpg_attrib_srp_sq_size_store(struct config_item *item,
 {
 	struct se_portal_group *se_tpg = attrib_to_tpg(item);
 	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
+	const struct ib_device_attr *attrs = &sport->sdev->device->attrs;
+	u32 rq_size = min(attrs->max_qp_wr, MAX_SRPT_RQ_SIZE);
 	unsigned long val;
 	int ret;
 
@@ -3621,6 +3623,11 @@ static ssize_t srpt_tpg_attrib_srp_sq_size_store(struct config_item *item,
 			MIN_SRPT_SRQ_SIZE);
 		return -EINVAL;
 	}
+	if (val + rq_size > attrs->max_cqe) {
+		pr_err("val: %lu exceeds max_cqe: %u minus rq_size: %u\n",
+		       val, attrs->max_cqe, rq_size);
+		return -EINVAL;
+	}
 	sport->port_attrib.srp_sq_size = val;
 
 	return count;
-- 
2.53.0

Re: [PATCH v4] RDMA/srpt: Reject an srp_sq_size that does not fit in a CQ

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ib_srpt: UAF in configfs store due to hot-unplug race
--

commit 1f57db75193afbb14a2edb4aa5126369171bf0a9
Author: Serhat Kumral <serhatkumral1@gmail.com>

RDMA/srpt: Reject an srp_sq_size that does not fit in a CQ

This commit modifies the configfs store function for srp_sq_size to validate
the requested size against the device's max_cqe limit, preventing continuous
CQ allocation failures that can lead to memory exhaustion.

> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -3603,6 +3603,8 @@ static ssize_t srpt_tpg_attrib_srp_sq_size_store(struct config_item *item,
>  {
>  	struct se_portal_group *se_tpg = attrib_to_tpg(item);
>  	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
> +	const struct ib_device_attr *attrs = &sport->sdev->device->attrs;
> +	u32 rq_size = min(attrs->max_qp_wr, MAX_SRPT_RQ_SIZE);

[Severity: High]
Is it safe to unconditionally dereference sport->sdev->device here?

If an InfiniBand device is hot-removed, srpt_remove_one() drops the driver's
reference to sdev, but configfs items created via srpt_make_tport() can hold
additional references, keeping the sport structure alive.

Once srpt_remove_one() returns, the IB core drops its reference to the
ib_device, freeing it. If a user writes to the srp_sq_size configfs
attribute during or after this process, couldn't this access the freed
ib_device and trigger a use-after-free?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925213629.8039-1-serhatkumral1@gmail.com?part=1