On 28/10/2022 17:04, Daisuke Matsuda wrote: > The function check_length() is supposed to check the length of inbound > packets on responder, but it actually has been a stub since the driver was > born. Let it check the payload length and the DMA length. > > Signed-off-by: Daisuke Matsuda <matsuda-daisuke@xxxxxxxxxxx> > --- > FOR REVIEWERS > I referred to IB Specification Vol 1-Revision-1.5 to create this patch. > Please see 9.7.4.1.6 (page.330). > > drivers/infiniband/sw/rxe/rxe_resp.c | 36 ++++++++++++++++++++++------ > 1 file changed, 29 insertions(+), 7 deletions(-) > > diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c > index ed5a09e86417..62e3a8195072 100644 > --- a/drivers/infiniband/sw/rxe/rxe_resp.c > +++ b/drivers/infiniband/sw/rxe/rxe_resp.c > @@ -390,16 +390,38 @@ static enum resp_states check_resource(struct rxe_qp *qp, > static enum resp_states check_length(struct rxe_qp *qp, > struct rxe_pkt_info *pkt) > { > - switch (qp_type(qp)) { > - case IB_QPT_RC: > - return RESPST_CHK_RKEY; > + int mtu = qp->mtu; > + u32 payload = payload_size(pkt); > + u32 dmalen = reth_len(pkt); > > - case IB_QPT_UC: > - return RESPST_CHK_RKEY; > + /* RoCEv2 packets do not have LRH. > + * Let's skip checking it. > + */ > > - default: > - return RESPST_CHK_RKEY; > + if ((pkt->opcode & RXE_START_MASK) && > + (pkt->opcode & RXE_END_MASK)) { > + /* "only" packets */ > + if (payload > mtu) > + return RESPST_ERR_LENGTH; > + > + } else if ((pkt->opcode & RXE_START_MASK) || > + (pkt->opcode & RXE_MIDDLE_MASK)) { > + /* "first" or "middle" packets */ > + if (payload != mtu) > + return RESPST_ERR_LENGTH; > + > + } else if (pkt->opcode & RXE_END_MASK) { > + /* "last" packets */ > + if ((pkt->paylen == 0) || (pkt->paylen > mtu)) As per IBA spec, i didn't see any difference about the 'packet payload length' from others, so May I know why here you are using 'pkt->paylen' instead of payload ? Thanks Zhijian > + return RESPST_ERR_LENGTH; > + } > + > + if (pkt->opcode & (RXE_WRITE_MASK | RXE_READ_MASK)) { > + if (dmalen > (1 << 31)) > + return RESPST_ERR_LENGTH; > } > + > + return RESPST_CHK_RKEY; > } > > static enum resp_states check_rkey(struct rxe_qp *qp,