diff options
| author | Bryan O'Sullivan <bos@pathscale.com> | 2006-07-01 04:35:55 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-07-01 09:55:59 -0700 |
| commit | 4a45b7d4ece0e6dc425e9f66fa8b501b72d846db (patch) | |
| tree | 6e858b3343ffb3670eb6f5a838479d52791e0a30 /drivers | |
| parent | 6665ddee85bfc336d691ea5132a2c20a1d0e8053 (diff) | |
| download | lwn-4a45b7d4ece0e6dc425e9f66fa8b501b72d846db.tar.gz lwn-4a45b7d4ece0e6dc425e9f66fa8b501b72d846db.zip | |
[PATCH] IB/ipath: don't allow resources to be created with illegal values
Signed-off-by: Robert Walsh <robert.walsh@qlogic.com>
Signed-off-by: Bryan O'Sullivan <bryan.osullivan@qlogic.com>
Cc: "Michael S. Tsirkin" <mst@mellanox.co.il>
Cc: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/ipath/ipath_mr.c | 5 | ||||
| -rw-r--r-- | drivers/infiniband/hw/ipath/ipath_qp.c | 8 | ||||
| -rw-r--r-- | drivers/infiniband/hw/ipath/ipath_verbs.c | 11 |
3 files changed, 24 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/ipath/ipath_mr.c b/drivers/infiniband/hw/ipath/ipath_mr.c index 30936769ab3a..4ac31a5da330 100644 --- a/drivers/infiniband/hw/ipath/ipath_mr.c +++ b/drivers/infiniband/hw/ipath/ipath_mr.c @@ -170,6 +170,11 @@ struct ib_mr *ipath_reg_user_mr(struct ib_pd *pd, struct ib_umem *region, int n, m, i; struct ib_mr *ret; + if (region->length == 0) { + ret = ERR_PTR(-EINVAL); + goto bail; + } + n = 0; list_for_each_entry(chunk, ®ion->chunk_list, list) n += chunk->nents; diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c index 47271be65b0f..e6fc4c02823f 100644 --- a/drivers/infiniband/hw/ipath/ipath_qp.c +++ b/drivers/infiniband/hw/ipath/ipath_qp.c @@ -667,6 +667,14 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd, goto bail; } + if (init_attr->cap.max_send_sge + + init_attr->cap.max_recv_sge + + init_attr->cap.max_send_wr + + init_attr->cap.max_recv_wr == 0) { + ret = ERR_PTR(-EINVAL); + goto bail; + } + switch (init_attr->qp_type) { case IB_QPT_UC: case IB_QPT_RC: diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c index 6af5402fe447..18375e831744 100644 --- a/drivers/infiniband/hw/ipath/ipath_verbs.c +++ b/drivers/infiniband/hw/ipath/ipath_verbs.c @@ -792,6 +792,17 @@ static struct ib_ah *ipath_create_ah(struct ib_pd *pd, goto bail; } + if (ah_attr->dlid == 0) { + ret = ERR_PTR(-EINVAL); + goto bail; + } + + if (ah_attr->port_num != 1 || + ah_attr->port_num > pd->device->phys_port_cnt) { + ret = ERR_PTR(-EINVAL); + goto bail; + } + ah = kmalloc(sizeof *ah, GFP_ATOMIC); if (!ah) { ret = ERR_PTR(-ENOMEM); |