Re: [PATCH rdma-next 06/23] RDMA/mlx5: Require IB_QPT_DRIVER for the DC vendor QP types

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The commit "RDMA/mlx5: Require IB_QPT_DRIVER for the DC vendor
  QP types" fixes a regression that userspace can trigger, but its…

--

RDMA/mlx5: Require IB_QPT_DRIVER for the DC vendor QP types

This patch changes process_vendor_flags() in drivers/infiniband/hw/mlx5/qp.c
so that it rejects MLX5_QP_FLAG_TYPE_DCI and MLX5_QP_FLAG_TYPE_DCT unless
the QP was requested as IB_QPT_DRIVER. Without this check, an RC/UC/UD QP
that carries a DC flag becomes a DC QP and skips the dct capability check
in check_qp_type().

> Accept the DC type flags only on IB_QPT_DRIVER, the type userspace
> uses to create DC QPs.
>
> Signed-off-by: Yishai Hadas <yishaih@nvidia.com>

[Severity: Medium]
Should this patch carry a Fixes: tag and Cc: stable? Userspace can reach
the behavior it fixes, and nothing in the message tells stable maintainers
to pick it up.

The problem seems to come from commit 37518fa49f76 ("RDMA/mlx5: Process
all vendor flags in one place"). That commit changed the guard around the
process_vendor_flags() call in the create path from:

    if (init_attr->qp_type == IB_QPT_DRIVER)

to:

    if (udata)

After that, the DCI/DCT type flags were processed for every user QP type.

Commit 7aede1a25f4b ("RDMA/mlx5: Store QP type in the vendor QP
structure") then made the switch in process_vendor_flags() write
qp->type = MLX5_IB_QPT_DCI or MLX5_IB_QPT_DCT directly. It still did not
check which type was requested.

>From then on, an unprivileged verbs user can create an IB_QPT_RC QP with
MLX5_QP_FLAG_TYPE_DCT set in the ucmd flags and get this path:

mlx5_ib_create_qp()
  check_qp_type()          <- dct cap only checked for IB_QPT_DRIVER
  qp->type = IB_QPT_RC;
  process_vendor_flags()
    qp->type = MLX5_IB_QPT_DCT;
  check_qp_attr()
  create_qp()

check_qp_attr(), create_qp() and the modify/query/destroy paths then
dispatch on the mlx5 qp->type. Meanwhile ibqp->qp_type still says
IB_QPT_RC.

Since this goes back to the 2020 refactor (v5.8), would something like
the following be appropriate?

Fixes: 37518fa49f76 ("RDMA/mlx5: Process all vendor flags in one place")
Cc: stable@vger.kernel.org

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261103163949.1554-1-yishaih%40nvidia.com