[qib7322] Validate payload length

There is no way for the hardware to give us an invalid length in the
LRH, since it must have parsed this length field in order to perform
header splitting.  However, this is difficult to prove conclusively.

Add an unnecessary length check to explicitly reject any packets
larger than the posted receive I/O buffer.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/drivers/infiniband/qib7322.c b/src/drivers/infiniband/qib7322.c
index 3bd587ec074768251dcee3cd5fbc201869dbe7eb..af7006e042c192c23bc64ca0728ca56bb74b5ef9 100644 (file)
--- a/src/drivers/infiniband/qib7322.c
+++ b/src/drivers/infiniband/qib7322.c
@@ -1507,8 +1507,15 @@ static void qib7322_complete_recv ( struct ib_device *ibdev,
                        /* Completing the eager buffer described in
                         * this header entry.
                         */
-                       iob_put ( iobuf, payload_len );
-                       rc = ( err ? -EIO : ( useegrbfr ? 0 : -ECANCELED ) );
+                       if ( payload_len <= iob_tailroom ( iobuf ) ) {
+                               iob_put ( iobuf, payload_len );
+                               rc = ( err ?
+                                      -EIO : ( useegrbfr ? 0 : -ECANCELED ) );
+                       } else {
+                               DBGC ( qib7322, "QIB7322 %p bad payload len "
+                                      "%zd\n", qib7322, payload_len );
+                               rc = -EPROTO;
+                       }
                        /* Redirect to target QP if necessary */
                        if ( qp != intended_qp ) {
                                DBGC2 ( qib7322, "QIB7322 %p redirecting QPN "
@@ -1519,7 +1526,7 @@ static void qib7322_complete_recv ( struct ib_device *ibdev,
                                intended_qp->recv.fill++;
                        }
                        ib_complete_recv ( ibdev, intended_qp, &dest, &source,
-                                          iobuf, rc);
+                                          iobuf, rc );
                } else {
                        /* Completing on a skipped-over eager buffer */
                        ib_complete_recv ( ibdev, qp, &dest, &source, iobuf,