linux-kernel - RE: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before installing cq callbacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 24 Apr 2024 08:58:11 +0000
From: Konstantin Taranov <kotaranov@...rosoft.com>
To: Long Li <longli@...rosoft.com>, Konstantin Taranov
	<kotaranov@...ux.microsoft.com>, "sharmaajay@...rosoft.com"
	<sharmaajay@...rosoft.com>, "jgg@...pe.ca" <jgg@...pe.ca>, "leon@...nel.org"
	<leon@...nel.org>
CC: "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH rdma-next 5/6] RDMA/mana_ib: boundary check before
 installing cq callbacks

> > Add a boundary check inside mana_ib_install_cq_cb to prevent index
> > overflow.
> 
> How is this condition possible that we are getting an out of bound queue id
> from SOC?
> 

Yes, it should not happen as the HW says the upper limit on CQ_ID,
but I think it is safer to have it to dodge bugs/faulty HW.
Better safe than sorry.
You can see the same check all over the mana.ko module.


> >
> > Fixes: 2a31c5a7e0d8 ("RDMA/mana_ib: Introduce mana_ib_install_cq_cb
> > helper function")
> > Signed-off-by: Konstantin Taranov <kotaranov@...rosoft.com>
> > ---
> >  drivers/infiniband/hw/mana/cq.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/infiniband/hw/mana/cq.c
> > b/drivers/infiniband/hw/mana/cq.c index 6c3bb8c..8323085 100644
> > --- a/drivers/infiniband/hw/mana/cq.c
> > +++ b/drivers/infiniband/hw/mana/cq.c
> > @@ -70,6 +70,8 @@ int mana_ib_install_cq_cb(struct mana_ib_dev
> *mdev,
> > struct mana_ib_cq *cq)
> >  	struct gdma_context *gc = mdev_to_gc(mdev);
> >  	struct gdma_queue *gdma_cq;
> >
> > +	if (cq->queue.id >= gc->max_num_cqs)
> > +		return -EINVAL;
> >  	/* Create CQ table entry */
> >  	WARN_ON(gc->cq_table[cq->queue.id]);
> >  	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
> > --
> > 2.43.0