mlx5_poll_one() trusts the CQE content, so it must not run on a CQE from an untrusted NIC. In adversarial mode no CQ needs it: the UMR CQ has its own poll_one that validates the CQE, kernel ULPs don't bind to the device, and user CQs are polled by userspace. Refuse it there, so an unexpected caller, such as the uverbs POLL_CQ command, finds the CQ empty and no CQE is interpreted. Signed-off-by: Yishai Hadas --- drivers/infiniband/hw/mlx5/cq.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c index 1a98263ec311..5cc86c3f93f3 100644 --- a/drivers/infiniband/hw/mlx5/cq.c +++ b/drivers/infiniband/hw/mlx5/cq.c @@ -464,6 +464,15 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq, void *cqe; int idx; + /* + * This path trusts the CQE, so refuse it in adversarial_mode. Only an + * unexpected caller gets here, e.g. the uverbs POLL_CQ command or an + * event on the UMR CQ before its own poll_one is installed. Nothing is + * consumed, so such a CQE is left for that poll_one. + */ + if (unlikely(mlx5_ib_adversarial_mode)) + return -EOPNOTSUPP; + repoll: cqe = next_cqe_sw(cq); if (!cqe) -- 2.18.1