diff options
author | David Dillow <dillowda@ornl.gov> | 2008-04-17 00:01:12 -0400 |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2008-04-17 00:01:12 -0400 |
commit | 1e89a1946cfd906d12eff437d2a76b3aa7f5e731 (patch) | |
tree | 2f48454d19bb6d6e07c5161d3307b68dc4978393 /drivers | |
parent | 826d801009fb3c82832f2d92149446cce354bf61 (diff) |
IB/srp: Enforce protocol limit on srp_sg_tablesize
The current SRP initiator will allow unlimited s/g entries in the
indirect descriptors lists, but the entry count field in the SRP_CMD
request is 8 bits, so setting srp_sg_tablesize too large will open the
possibility of wrapping the count and generating invalid requests.
Clamp srp_sg_tablesize to the protocol limits to prevent surprises.
Reported by Martin W. Schlining III <mschlining@datadirectnet.com>.
Signed-off-by: David Dillow <dillowda@ornl.gov>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/infiniband/ulp/srp/ib_srp.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index fd4a49fc4773..125765aa9d59 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c | |||
@@ -68,7 +68,7 @@ static int srp_max_iu_len; | |||
68 | 68 | ||
69 | module_param(srp_sg_tablesize, int, 0444); | 69 | module_param(srp_sg_tablesize, int, 0444); |
70 | MODULE_PARM_DESC(srp_sg_tablesize, | 70 | MODULE_PARM_DESC(srp_sg_tablesize, |
71 | "Max number of gather/scatter entries per I/O (default is 12)"); | 71 | "Max number of gather/scatter entries per I/O (default is 12, max 255)"); |
72 | 72 | ||
73 | static int topspin_workarounds = 1; | 73 | static int topspin_workarounds = 1; |
74 | 74 | ||
@@ -2138,6 +2138,11 @@ static int __init srp_init_module(void) | |||
2138 | { | 2138 | { |
2139 | int ret; | 2139 | int ret; |
2140 | 2140 | ||
2141 | if (srp_sg_tablesize > 255) { | ||
2142 | printk(KERN_WARNING PFX "Clamping srp_sg_tablesize to 255\n"); | ||
2143 | srp_sg_tablesize = 255; | ||
2144 | } | ||
2145 | |||
2141 | ib_srp_transport_template = | 2146 | ib_srp_transport_template = |
2142 | srp_attach_transport(&ib_srp_transport_functions); | 2147 | srp_attach_transport(&ib_srp_transport_functions); |
2143 | if (!ib_srp_transport_template) | 2148 | if (!ib_srp_transport_template) |