Re: [PATCH v3 0/2] RDMA/srp: bound the receive IU the target asks for

[Leon Romanovsky]

On Mon, 02 Nov 2026 15:19:36 +0900, Yehyeong Lee wrote:
> The target decides how large the initiator's receive buffers are, and the
> initiator never checks the answer.
> 
> srp_cm_rep_handler() takes max_ti_iu_len out of the SRP_LOGIN_RSP and
> srp_alloc_iu_bufs() sizes every receive IU with it. The first patch refuses
> a login that reports less than an SRP_RSP, because such a login hands the
> receive path undersized buffers, and a report of zero is worse: kzalloc()
> answers it with ZERO_SIZE_PTR, which ib_dma_map_single() accepts on a
> virtually mapped transport without looking at the length.
> 
> [...]

Applied, thanks!

[1/2] RDMA/srp: refuse a target that cannot receive an SRP_RSP
      https://git.kernel.org/rdma/rdma/c/bac7e7bf07cb64
[2/2] RDMA/srp: do not DMA-sync a receive IU past its mapped length
      https://git.kernel.org/rdma/rdma/c/915fb85a378e02

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>