| Message ID | 20241120211809.922-1-m.masimov@maxima.ru (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | RDMA/irdma: prevent out-of-bounds shift on timeout calculation | expand |
diff --git a/drivers/infiniband/hw/irdma/cm.h b/drivers/infiniband/hw/irdma/cm.h index 48ee285cf745..dc4ee1b185eb 100644 --- a/drivers/infiniband/hw/irdma/cm.h +++ b/drivers/infiniband/hw/irdma/cm.h @@ -41,7 +41,7 @@ #define TCP_OPTIONS_PADDING 3 #define IRDMA_DEFAULT_RETRYS 64 -#define IRDMA_DEFAULT_RETRANS 32 +#define IRDMA_DEFAULT_RETRANS 20 #define IRDMA_DEFAULT_TTL 0x40 #define IRDMA_DEFAULT_RTT_VAR 6 #define IRDMA_DEFAULT_SS_THRESH 0x3fffffff
After some finite number of tries, bitshift in the calculation of timetosend at function irdma_cm_timer_tick() will lead to out-of-bounds shift, which in this case is an undefined behaviour. For instance, if HZ is equal to 1024, the issue occurs after 21 tries, which will take less than IRDMA_MAX_TIMEOUT / HZ * 21 = 252 seconds. Lower IRDMA_DEFAULT_RETRANS from 32 to 20 to prevent out-of-bounds shift for any HZ value less than 2048. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8385a875c9ee ("RDMA/irdma: Increase iWARP CM default rexmit count") Signed-off-by: Murad Masimov <m.masimov@maxima.ru> --- drivers/infiniband/hw/irdma/cm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.39.2