From: David Dillow Date: Thu, 17 Apr 2008 04:01:12 +0000 (-0700) Subject: IB/srp: Enforce protocol limit on srp_sg_tablesize X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=1e89a1946cfd906d12eff437d2a76b3aa7f5e731;p=deliverable%2Flinux.git IB/srp: Enforce protocol limit on srp_sg_tablesize The current SRP initiator will allow unlimited s/g entries in the indirect descriptors lists, but the entry count field in the SRP_CMD request is 8 bits, so setting srp_sg_tablesize too large will open the possibility of wrapping the count and generating invalid requests. Clamp srp_sg_tablesize to the protocol limits to prevent surprises. Reported by Martin W. Schlining III . Signed-off-by: David Dillow Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index fd4a49fc4773..125765aa9d59 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -68,7 +68,7 @@ static int srp_max_iu_len; module_param(srp_sg_tablesize, int, 0444); MODULE_PARM_DESC(srp_sg_tablesize, - "Max number of gather/scatter entries per I/O (default is 12)"); + "Max number of gather/scatter entries per I/O (default is 12, max 255)"); static int topspin_workarounds = 1; @@ -2138,6 +2138,11 @@ static int __init srp_init_module(void) { int ret; + if (srp_sg_tablesize > 255) { + printk(KERN_WARNING PFX "Clamping srp_sg_tablesize to 255\n"); + srp_sg_tablesize = 255; + } + ib_srp_transport_template = srp_attach_transport(&ib_srp_transport_functions); if (!ib_srp_transport_template)