Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967162AbcKXPgw (ORCPT ); Thu, 24 Nov 2016 10:36:52 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:58296 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966044AbcKXPcl (ORCPT ); Thu, 24 Nov 2016 10:32:41 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Gottlieb , Yishai Hadas , Leon Romanovsky , Doug Ledford Subject: [PATCH 4.8 56/67] IB/mlx5: Validate requested RQT size Date: Thu, 24 Nov 2016 16:27:50 +0100 Message-Id: <20161124145500.216438468@linuxfoundation.org> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20161124145457.061710350@linuxfoundation.org> References: <20161124145457.061710350@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1338 Lines: 39 4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maor Gottlieb commit efd7f40082a0dfd112eb87ff2124467a5739216f upstream. Validate that the requested size of RQT is supported by firmware. Fixes: c5f9092936fe ('IB/mlx5: Add Receive Work Queue Indirection table operations') Signed-off-by: Maor Gottlieb Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/mlx5/qp.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -4702,6 +4702,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_ udata->inlen)) return ERR_PTR(-EOPNOTSUPP); + if (init_attr->log_ind_tbl_size > + MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) { + mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n", + init_attr->log_ind_tbl_size, + MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)); + return ERR_PTR(-EINVAL); + } + min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved); if (udata->outlen && udata->outlen < min_resp_len) return ERR_PTR(-EINVAL);