[bug report] RDMA/mana_ib: create kernel-level CQs

[bug report] RDMA/mana_ib: create kernel-level CQs

[Dan Carpenter]

Hello Konstantin Taranov,

Commit bec127e45d9f ("RDMA/mana_ib: create kernel-level CQs") from
Jan 20, 2025 (linux-next), leads to the following Smatch static
checker warning:

	drivers/infiniband/hw/mana/cq.c:59 mana_ib_create_cq()
	warn: potential user controlled sizeof overflow 'attr->cqe * 64' '0-u32max(user) * 64'

drivers/infiniband/hw/mana/cq.c
    8 int mana_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
    9                       struct uverbs_attr_bundle *attrs)
    10 {
    11         struct ib_udata *udata = &attrs->driver_udata;
    12         struct mana_ib_cq *cq = container_of(ibcq, struct mana_ib_cq, ibcq);
    13         struct mana_ib_create_cq_resp resp = {};
    14         struct mana_ib_ucontext *mana_ucontext;
    15         struct ib_device *ibdev = ibcq->device;
    16         struct mana_ib_create_cq ucmd = {};
    17         struct mana_ib_dev *mdev;
    18         bool is_rnic_cq;
    19         u32 doorbell;
    20         u32 buf_size;
    21         int err;
    22 
    23         mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
    24 
    25         cq->comp_vector = attr->comp_vector % ibdev->num_comp_vectors;
    26         cq->cq_handle = INVALID_MANA_HANDLE;
    27 
    28         if (udata) {
    29                 if (udata->inlen < offsetof(struct mana_ib_create_cq, flags))
    30                         return -EINVAL;
    31 
    32                 err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen));
    33                 if (err) {
    34                         ibdev_dbg(ibdev, "Failed to copy from udata for create cq, %d\n", err);
    35                         return err;
    36                 }
    37 
    38                 is_rnic_cq = !!(ucmd.flags & MANA_IB_CREATE_RNIC_CQ);
    39 
    40                 if ((!is_rnic_cq && attr->cqe > mdev->adapter_caps.max_qp_wr) ||
    41                     attr->cqe > U32_MAX / COMP_ENTRY_SIZE) {
    42                         ibdev_dbg(ibdev, "CQE %d exceeding limit\n", attr->cqe);
    43                         return -EINVAL;
    44                 }
    45 
    46                 cq->cqe = attr->cqe;
    47                 err = mana_ib_create_queue(mdev, ucmd.buf_addr, cq->cqe * COMP_ENTRY_SIZE,
    48                                            &cq->queue);
    49                 if (err) {
    50                         ibdev_dbg(ibdev, "Failed to create queue for create cq, %d\n", err);
    51                         return err;
    52                 }
    53 
    54                 mana_ucontext = rdma_udata_to_drv_context(udata, struct mana_ib_ucontext,
    55                                                           ibucontext);
    56                 doorbell = mana_ucontext->doorbell;
    57         } else {
    58                 is_rnic_cq = true;
--> 59                 buf_size = MANA_PAGE_ALIGN(roundup_pow_of_two(attr->cqe * COMP_ENTRY_SIZE));

The static checker says that attr->cqe comes from the user and
this math can integer overflow.

The call tree is:

add_target_store()  <-  This gets the target->queue_size from the user
                        via srp_parse_options().  It has some bounds checking
                        but the result could be still be negative because of
                        integer overflows in the srp_parse_options() funtion
                        itself.  Plus INT_MAX can overflow as well later.
                        To be honest, ideally we would want to silence the
                        integer overflow in srp_parse_options() instead of
                        following it all the way through the call tree.

-> srp_create_ch_ib:
   -> ib_alloc_cq:
      -> __ib_alloc_cq() calls: ret = dev->ops.create_cq(cq, &cq_attr, NULL);
         -> mana_ib_create_cq()

    60                 cq->cqe = buf_size / COMP_ENTRY_SIZE;
    61                 err = mana_ib_create_kernel_queue(mdev, buf_size, GDMA_CQ, &cq->queue);
    62                 if (err) {
    63                         ibdev_dbg(ibdev, "Failed to create kernel queue for create cq, %d\n", err);
    64                         return err;
    65                 }
    66                 doorbell = mdev->gdma_dev->doorbell;
    67         }
    68 
    69         if (is_rnic_cq) {

regards,
dan carpenter

RE: [EXTERNAL] [bug report] RDMA/mana_ib: create kernel-level CQs

[Konstantin Taranov]

> Hello Konstantin Taranov,
> 
> Commit bec127e45d9f ("RDMA/mana_ib: create kernel-level CQs") from Jan
> 20, 2025 (linux-next), leads to the following Smatch static checker warning:
> 
> 	drivers/infiniband/hw/mana/cq.c:59 mana_ib_create_cq()
> 	warn: potential user controlled sizeof overflow 'attr->cqe * 64' '0-
> u32max(user) * 64'

Thanks for catching this. I will make a fix this week.

- Konstantin