linux-kernel - [RFC PATCH 12/25] NTB: ntb_transport: Stricter checks for peer-reported interrupt values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251023071916.901355-13-den@valinux.co.jp>
Date: Thu, 23 Oct 2025 16:19:03 +0900
From: Koichiro Den <den@...inux.co.jp>
To: ntb@...ts.linux.dev,
	linux-pci@...r.kernel.org,
	dmaengine@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: mani@...nel.org,
	kwilczynski@...nel.org,
	kishon@...nel.org,
	bhelgaas@...gle.com,
	corbet@....net,
	vkoul@...nel.org,
	jdmason@...zu.us,
	dave.jiang@...el.com,
	allenbh@...il.com,
	Basavaraj.Natikar@....com,
	Shyam-sundar.S-k@....com,
	kurt.schwemmer@...rosemi.com,
	logang@...tatee.com,
	jingoohan1@...il.com,
	lpieralisi@...nel.org,
	robh@...nel.org,
	jbrunet@...libre.com,
	Frank.Li@....com,
	fancer.lancer@...il.com,
	arnd@...db.de,
	pstanner@...hat.com,
	elfring@...rs.sourceforge.net
Subject: [RFC PATCH 12/25] NTB: ntb_transport: Stricter checks for peer-reported interrupt values

addr_offset and/or data may legitimately be zero, depending on alignment
constraints. Introduce more clearly invalid default values and
strengthen validation of peer-reported ones to prevent false rejections.

Signed-off-by: Koichiro Den <den@...inux.co.jp>
---
 drivers/ntb/ntb_transport.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 3f3bc991e667..d9fc450ef497 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -69,6 +69,9 @@
 #define NTB_TRANSPORT_DESC	"Software Queue-Pair Transport over NTB"
 #define NTB_TRANSPORT_MIN_SPADS (MW0_SZ_HIGH + 2)
 
+#define INTR_INVALID_ADDR_OFFSET	U32_MAX
+#define INTR_INVALID_DATA		U32_MAX
+
 MODULE_DESCRIPTION(NTB_TRANSPORT_DESC);
 MODULE_VERSION(NTB_TRANSPORT_VER);
 MODULE_LICENSE("Dual BSD/GPL");
@@ -715,7 +718,11 @@ static void ntb_transport_setup_qp_peer_msi(struct ntb_transport_ctx *nt,
 	dev_dbg(&qp->ndev->pdev->dev, "QP%d Peer MSI addr=%x data=%x\n",
 		qp_num, qp->peer_msi_desc.addr_offset, qp->peer_msi_desc.data);
 
-	if (qp->peer_msi_desc.addr_offset) {
+	if (qp->peer_msi_desc.addr_offset == INTR_INVALID_ADDR_OFFSET ||
+	    qp->peer_msi_desc.data == INTR_INVALID_DATA)
+		dev_info(&qp->ndev->pdev->dev,
+			 "Invalid addr_offset or data, falling back to doorbell\n");
+	else {
 		qp->use_msi = true;
 		dev_info(&qp->ndev->pdev->dev,
 			 "Using MSI interrupts for QP%d\n", qp_num);
@@ -723,12 +730,18 @@ static void ntb_transport_setup_qp_peer_msi(struct ntb_transport_ctx *nt,
 }
 
 static void ntb_transport_setup_qp_msi(struct ntb_transport_ctx *nt,
-				       unsigned int qp_num)
+				       unsigned int qp_num, bool changed)
 {
 	struct ntb_transport_qp *qp = &nt->qp_vec[qp_num];
 	int spad = qp_num * 2 + nt->msi_spad_offset;
 	int rc;
 
+	if (!changed && qp->msi_irq)
+		return;
+
+	ntb_spad_write(qp->ndev, spad, INTR_INVALID_ADDR_OFFSET);
+	ntb_spad_write(qp->ndev, spad + 1, INTR_INVALID_DATA);
+
 	if (!nt->use_msi)
 		return;
 
@@ -738,9 +751,6 @@ static void ntb_transport_setup_qp_msi(struct ntb_transport_ctx *nt,
 		return;
 	}
 
-	ntb_spad_write(qp->ndev, spad, 0);
-	ntb_spad_write(qp->ndev, spad + 1, 0);
-
 	if (!qp->msi_irq) {
 		qp->msi_irq = ntbm_msi_request_irq(qp->ndev, ntb_transport_isr,
 						   KBUILD_MODNAME, qp,
@@ -789,7 +799,7 @@ static void ntb_transport_msi_desc_changed(void *data)
 	dev_dbg(&nt->ndev->pdev->dev, "MSI descriptors changed");
 
 	for (i = 0; i < nt->qp_count; i++)
-		ntb_transport_setup_qp_msi(nt, i);
+		ntb_transport_setup_qp_msi(nt, i, true);
 
 	ntb_peer_db_set(nt->ndev, nt->msi_db_mask);
 }
@@ -1068,7 +1078,7 @@ static void ntb_transport_link_work(struct work_struct *work)
 	}
 
 	for (i = 0; i < nt->qp_count; i++)
-		ntb_transport_setup_qp_msi(nt, i);
+		ntb_transport_setup_qp_msi(nt, i, false);
 
 	for (i = 0; i < nt->mw_count; i++) {
 		size = nt->mw_vec[i].phys_size;
-- 
2.48.1