[ofa-general] [PATCH] IB/srp: enforce protocol limit on srp_sg_tablesize

[David Dillow]

The current SRP initiator will allow unlimited s/g entries in the
indirect descriptors lists, but the entry count field in the SRP_CMD
request is 8 bits, so setting srp_sg_tablesize too large will open the
possibility of wrapping the count and generating invalid requests.

Clamp srp_sg_tablesize to the protocol limits to prevent surprises.

Reported-by: Martin W. Schlining III <mschlining at datadirectnet.com>
Signed-off-by: David Dillow <dillowda at ornl.gov>
---
On Mon, 2008-03-17 at 12:34 -0700, Roland Dreier wrote:
> > The current SRP initiator will allow unlimited s/g entries in the
>  > indirect descriptors lists, but the entry count field in the SRP_CMD
>  > request is 8 bits, so setting srp_sg_tablesize too large will open the
>  > possibility of wrapping the count and generating invalid requests.
> 
> makes sense, but...
> 
>  > +	if (srp_sg_tablesize > 255) {
>  > +		printk(KERN_ERR PFX "srp_sg_tablesize too large\n");
>  > +		return -EINVAL;
>  > +	}
> 
> friendlier to clamp it to 255 and print a warning?  what do you think?

Sure, here's an updated patch.

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index fd4a49f..b536841 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -68,7 +68,7 @@ static int srp_max_iu_len;
 
 module_param(srp_sg_tablesize, int, 0444);
 MODULE_PARM_DESC(srp_sg_tablesize,
-		 "Max number of gather/scatter entries per I/O (default is 12)");
+		 "Max number of gather/scatter entries per I/O (default is 12, max 255)");
 
 static int topspin_workarounds = 1;
 
@@ -2138,6 +2138,11 @@ static int __init srp_init_module(void)
 {
 	int ret;
 
+	if (srp_sg_tablesize > 255) {
+		printk(KERN_WARNING PFX "clamping srp_sg_tablesize to 255\n");
+		srp_sg_tablesize = 255;
+	}
+
 	ib_srp_transport_template =
 		srp_attach_transport(&ib_srp_transport_functions);
 	if (!ib_srp_transport_template)