RDMA/mlx5: Add check for srq max_sge attribute

max_sge attribute is passed by the user, and is inserted and used
unchecked, so verify that the value doesn't exceed maximum allowed value
before using it.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Link: https://lore.kernel.org/r/277ccc29e8d57bfd53ddeb2ac633f2760cf8cdd0.1716900410.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index a056ea835da549c99396a4dcbcd5440cbda31868..84be0c3d569959d8837b8d71ab0edd188b6b7c8b 100644 (file)
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -199,17 +199,20 @@ int mlx5_ib_create_srq(struct ib_srq *ib_srq,
        int err;
        struct mlx5_srq_attr in = {};
        __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz);
+       __u32 max_sge_sz =  MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq) /
+                           sizeof(struct mlx5_wqe_data_seg);
 
        if (init_attr->srq_type != IB_SRQT_BASIC &&
            init_attr->srq_type != IB_SRQT_XRC &&
            init_attr->srq_type != IB_SRQT_TM)
                return -EOPNOTSUPP;
 
-       /* Sanity check SRQ size before proceeding */
-       if (init_attr->attr.max_wr >= max_srq_wqes) {
-               mlx5_ib_dbg(dev, "max_wr %d, cap %d\n",
-                           init_attr->attr.max_wr,
-                           max_srq_wqes);
+       /* Sanity check SRQ and sge size before proceeding */
+       if (init_attr->attr.max_wr >= max_srq_wqes ||
+           init_attr->attr.max_sge > max_sge_sz) {
+               mlx5_ib_dbg(dev, "max_wr %d,wr_cap %d,max_sge %d, sge_cap:%d\n",
+                           init_attr->attr.max_wr, max_srq_wqes,
+                           init_attr->attr.max_sge, max_sge_sz);
                return -EINVAL;
        }