From 1e89a1946cfd906d12eff437d2a76b3aa7f5e731 Mon Sep 17 00:00:00 2001 From: David Dillow Date: Wed, 16 Apr 2008 21:01:12 -0700 Subject: [PATCH] IB/srp: Enforce protocol limit on srp_sg_tablesize The current SRP initiator will allow unlimited s/g entries in the indirect descriptors lists, but the entry count field in the SRP_CMD request is 8 bits, so setting srp_sg_tablesize too large will open the possibility of wrapping the count and generating invalid requests. Clamp srp_sg_tablesize to the protocol limits to prevent surprises. Reported by Martin W. Schlining III . Signed-off-by: David Dillow Signed-off-by: Roland Dreier --- drivers/infiniband/ulp/srp/ib_srp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index fd4a49fc4773..125765aa9d59 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -68,7 +68,7 @@ static int srp_max_iu_len; module_param(srp_sg_tablesize, int, 0444); MODULE_PARM_DESC(srp_sg_tablesize, - "Max number of gather/scatter entries per I/O (default is 12)"); + "Max number of gather/scatter entries per I/O (default is 12, max 255)"); static int topspin_workarounds = 1; @@ -2138,6 +2138,11 @@ static int __init srp_init_module(void) { int ret; + if (srp_sg_tablesize > 255) { + printk(KERN_WARNING PFX "Clamping srp_sg_tablesize to 255\n"); + srp_sg_tablesize = 255; + } + ib_srp_transport_template = srp_attach_transport(&ib_srp_transport_functions); if (!ib_srp_transport_template) -- 2.39.5