diff options
| author | Quanye Yang <quanyeyang@proton.me> | 2026-09-22 21:09:58 -0700 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-09-29 14:23:56 -0400 |
| commit | 724cd362162ca7ca5a250bec65efd74f7dad9f5c (patch) | |
| tree | 0e31289a067bd2ecaa9f13ae94b8badbb9a66551 /drivers/infiniband/ulp | |
| parent | 9f4c322be27bf617cad2f4a15f6c6024a69e220c (diff) | |
| download | linux-724cd362162ca7ca5a250bec65efd74f7dad9f5c.tar.gz linux-724cd362162ca7ca5a250bec65efd74f7dad9f5c.zip | |
RDMA/rtrs-clt: Reject invalid queue_depth from the peer
queue_depth is taken from the server's CM private_data and later
used as a session invariant. A peer can send 0, which the client
stores and then trips WARN_ON() in create_con_cq_qp() when the
next connection is set up.
Reject a zero queue_depth on ESTABLISHED, same as a bad
magic or version, and fail the handshake with -ECONNRESET.
Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://lore.kernel.org/linux-rdma/CA+0ovCg_sG8gaZXXj9zmOrpxRt=8+-x9wvycVNUKwWmMbr6-Yg@mail.gmail.com
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
Link: https://patch.msgid.link/20260922-rtrs-fix-warning-rtrs-clt-rdma-cm-handler-v1-1-2076c0ee1455@proton.me
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/ulp')
| -rw-r--r-- | drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c index f48872bb0024..447aaa28fd5d 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -1852,6 +1852,10 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con, } if (con->c.cid == 0) { queue_depth = le16_to_cpu(msg->queue_depth); + if (!queue_depth) { + rtrs_err(clt, "Invalid queue depth %u\n", queue_depth); + return -ECONNRESET; + } if (clt_path->queue_depth > 0 && queue_depth != clt_path->queue_depth) { rtrs_err(clt, "Error: queue depth changed\n"); |