Re: [PATCH 06/10] RDMA/bnxt_re: Add compatibility checks to the uapi path

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/2/5 17:45, Jason Gunthorpe 写道:
> Check that the driver data is properly sized and properly zeroed by
> calling ib_copy_validate_udata_in().
> 
> Use git history to find the commit introducing each req struct and use
> that to select the end member.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>

Zhu Yanjun

> ---
>   drivers/infiniband/hw/bnxt_re/ib_verbs.c | 29 +++++++++++++-----------
>   1 file changed, 16 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index f19b55c13d5809..2942ff44f6a547 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -1655,9 +1655,11 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
>   	qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
>   
>   	uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
> -	if (udata)
> -		if (ib_copy_from_udata(&ureq, udata,  min(udata->inlen, sizeof(ureq))))
> -			return -EFAULT;
> +	if (udata) {
> +		rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
> +		if (rc)
> +			return rc;
> +	}
>   
>   	rc = bnxt_re_test_qp_limits(rdev, qp_init_attr, dev_attr);
>   	if (!rc) {
> @@ -1847,9 +1849,11 @@ static int bnxt_re_init_user_srq(struct bnxt_re_dev *rdev,
>   	int bytes = 0;
>   	struct bnxt_re_ucontext *cntx = rdma_udata_to_drv_context(
>   		udata, struct bnxt_re_ucontext, ib_uctx);
> +	int rc;
>   
> -	if (ib_copy_from_udata(&ureq, udata, sizeof(ureq)))
> -		return -EFAULT;
> +	rc = ib_copy_validate_udata_in(udata, ureq, srq_handle);
> +	if (rc)
> +		return rc;
>   
>   	bytes = (qplib_srq->max_wqe * qplib_srq->wqe_size);
>   	bytes = PAGE_ALIGN(bytes);
> @@ -3156,10 +3160,10 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
>   	cq->qplib_cq.sg_info.pgshft = PAGE_SHIFT;
>   	if (udata) {
>   		struct bnxt_re_cq_req req;
> -		if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> -			rc = -EFAULT;
> +
> +		rc = ib_copy_validate_udata_in(udata, req, cq_handle);
> +		if (rc)
>   			goto fail;
> -		}
>   
>   		cq->umem = ib_umem_get(&rdev->ibdev, req.cq_va,
>   				       entries * sizeof(struct cq_base),
> @@ -3289,10 +3293,9 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
>   		entries = dev_attr->max_cq_wqes + 1;
>   
>   	/* uverbs consumer */
> -	if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> -		rc = -EFAULT;
> +	rc = ib_copy_validate_udata_in(udata, req, cq_va);
> +	if (rc)
>   		goto fail;
> -	}
>   
>   	cq->resize_umem = ib_umem_get(&rdev->ibdev, req.cq_va,
>   				      entries * sizeof(struct cq_base),
> @@ -4391,8 +4394,8 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
>   	if (_is_host_msn_table(rdev->qplib_res.dattr->dev_cap_flags2))
>   		resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;
>   
> -	if (udata->inlen >= sizeof(ureq)) {
> -		rc = ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq)));
> +	if (udata->inlen) {
> +		rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
>   		if (rc)
>   			goto cfail;
>   		if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {