Re: [PATCH 2/2] RDMA/srp: drop a truncated SRP_RSP

[Bart Van Assche]

On 10/25/26 4:41 AM, Yehyeong Lee wrote:
> diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
> index a85d28b95306a..d891029087b7e 100644
> --- a/drivers/infiniband/ulp/srp/ib_srp.c
> +++ b/drivers/infiniband/ulp/srp/ib_srp.c
> @@ -1946,6 +1946,12 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp,
>   	struct scsi_cmnd *scmnd;
>   	unsigned long flags;
>   
> +	if (byte_len < sizeof(*rsp)) {
> +		shost_printk(KERN_ERR, target->scsi_host, PFX
> +			     "dropping truncated SRP_RSP (%u bytes)\n", byte_len);
> +		return;
> +	}
> +
>   	if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
>   		spin_lock_irqsave(&ch->lock, flags);
>   		ch->req_lim += be32_to_cpu(rsp->req_lim_delta);

Dropping a response causes its req_lim_delta credit to be lost. I'm
afraid this will cause trouble.

Thanks,

Bart.