Re: [PATCH v2 5/8] ib_uverbs: Add padding to end align ib_uverbs_reg_mr_resp

[Knut Omang]

On Tue, 2016-09-20 at 13:45 +0300, Yishai Hadas wrote:
> On 9/16/2016 9:31 PM, Knut Omang wrote:
> > 
> > The ib_uverbs_reg_mr_resp structure was not 64 bit end aligned
> > as required by the protocol. This causes alignment issues
> > if a device specific driver needs to transfer extra response
> > arguments.
> > 
> > Avoid breaking backward compatibility by improving the handling
> > of the length checking in ib_uverbs_reg_mr to consider the case
> > where the kernel has been updated, but user space still has
> > the old length without padding.
> > 
> > Signed-off-by: Knut Omang <knut.omang@xxxxxxxxxx>
> > ---
> > Âdrivers/infiniband/core/uverbs_cmd.c | 10 ++++++----
> > Âinclude/uapi/rdma/ib_user_verbs.hÂÂÂÂ|ÂÂ1 +
> > Â2 files changed, 7 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
> > index dbc5885..fa8a717 100644
> > --- a/drivers/infiniband/core/uverbs_cmd.c
> > +++ b/drivers/infiniband/core/uverbs_cmd.c
> > @@ -967,16 +967,18 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
> > Â	struct ib_pdÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ*pd;
> > Â	struct ib_mrÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ*mr;
> > Â	intÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂret;
> > +	size_t resp_size = sizeof resp;
> > 
> > -	if (out_len < sizeof resp)
> > -		return -ENOSPC;
> > +	if (out_len < resp_size) {
> > +		resp_size = out_len;
> > +	}
> You don't preserve the minimum response size error checking in your codeÂ
> (i.eÂÂ-ENOSPC). We can expect an error if outlen is less than the
> offset of rkey in ib_uverbs_reg_mr_resp.

I agree, the minimal size needs to be the minimal supported size,
in particular since the memory for cmd may contain arbitrary stack content.
Good catch!

> Please note that below call to copy_to_user will succeed as it copiesÂ
> now based on resp_size and won't return the basic mandatory output.

Get it - will fix,

Thanks,
Knut

> 
> > 
> > Â	if (copy_from_user(&cmd, buf, sizeof cmd))
> > Â		return -EFAULT;
> > 
> > Â	INIT_UDATA(&udata, buf + sizeof cmd,
> > Â		ÂÂÂ(unsigned long) cmd.response + sizeof resp,
> > -		ÂÂÂin_len - sizeof cmd, out_len - sizeof resp);
> > +		ÂÂÂin_len - sizeof cmd, out_len - resp_size);
> > 
> > Â	if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))
> > Â		return -EINVAL;
> > @@ -1030,7 +1032,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
> > Â	resp.mr_handle = uobj->id;
> > 
> > Â	if (copy_to_user((void __user *) (unsigned long) cmd.response,
> > -			Â&resp, sizeof resp)) {
> > +			Â&resp, resp_size)) {
> > Â		ret = -EFAULT;
> > Â		goto err_copy;
> > Â	}
> > diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
> > index 7f035f4..6b8c9c0 100644
> > --- a/include/uapi/rdma/ib_user_verbs.h
> > +++ b/include/uapi/rdma/ib_user_verbs.h
> > @@ -307,6 +307,7 @@ struct ib_uverbs_reg_mr_resp {
> > Â	__u32 mr_handle;
> > Â	__u32 lkey;
> > Â	__u32 rkey;
> > +	__u32 reserved;
> > Â};
> > 
> > Âstruct ib_uverbs_rereg_mr {
> >