Re: [PATCH 1/2] RDMA/srp: refuse a target that cannot receive an SRP_RSP

[Bart Van Assche]

On 10/25/26 4:41 AM, Yehyeong Lee wrote:
> diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
> index 5811f02df9805..a85d28b95306a 100644
> --- a/drivers/infiniband/ulp/srp/ib_srp.c
> +++ b/drivers/infiniband/ulp/srp/ib_srp.c
> @@ -2379,6 +2379,13 @@ static void srp_cm_rep_handler(struct ib_cm_id *cm_id,
>   
>   	if (lrsp->opcode == SRP_LOGIN_RSP) {
>   		ch->max_ti_iu_len = be32_to_cpu(lrsp->max_ti_iu_len);
> +		if (ch->max_ti_iu_len < sizeof(struct srp_rsp)) {
> +			shost_printk(KERN_ERR, target->scsi_host, PFX
> +				     "Target reported max_ti_iu_len %u, too small for a %zu byte SRP_RSP\n",
> +				     ch->max_ti_iu_len, sizeof(struct srp_rsp));
> +			ret = -ECONNRESET;
> +			goto error;
> +		}
>   		ch->req_lim       = be32_to_cpu(lrsp->req_lim_delta);
>   		ch->use_imm_data  = srp_use_imm_data &&
>   			(lrsp->rsp_flags & SRP_LOGIN_RSP_IMMED_SUPP);

Is this change perhaps incomplete? When reconnecting. 
srp_cm_rep_handler() only allocates the receive buffers when ch->rx_ring
== NULL. srp_rport_reconnect() calls srp_create_ch_ib() and the latter
function keeps rx_ring, but ch->max_ti_iu_len is overwritten from each
new SRP_LOGIN_RSP. If a target reports a larger value on reconnect,
srp_recv_done() calls ib_dma_sync_single_for_{cpu,device}(dev, iu->dma,
ch->max_ti_iu_len, ...) past the mapped length. That breaks the DMA API
rules. The HCA itself can't overrun, because srp_post_recv() uses
iu-> size. Since the series is about bounding the receive IU size,
please make one of these additional changes:
* use iu->size in the two sync calls in srp_recv_done(), or
* on reconnect, refuse (or reallocate for) a max_ti_iu_len larger than 
the existing rx_ring[0]->size.

Thanks,

Bart.