diff options
| author | Dean Luick <dean.luick@intel.com> | 2016-07-28 15:21:14 -0400 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2016-08-02 22:46:21 -0400 |
| commit | 4fa0d22c9a08f32df4d2f7683b1efe21d1a905ac (patch) | |
| tree | 579240f5aece95fac702c232247f024621105aa5 /drivers/infiniband | |
| parent | bdf7752e072f91fbeb1739da3938d4392ea8a51f (diff) | |
IB/hfi1: Validate SDMA user request index
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dean Luick <dean.luick@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/user_sdma.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c index 6b8d1e8b6286..0a0281ae35f1 100644 --- a/drivers/infiniband/hw/hfi1/user_sdma.c +++ b/drivers/infiniband/hw/hfi1/user_sdma.c @@ -552,6 +552,14 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, trace_hfi1_sdma_user_reqinfo(dd, uctxt->ctxt, fd->subctxt, (u16 *)&info); + + if (info.comp_idx >= hfi1_sdma_comp_ring_size) { + hfi1_cdbg(SDMA, + "[%u:%u:%u:%u] Invalid comp index", + dd->unit, uctxt->ctxt, fd->subctxt, info.comp_idx); + return -EINVAL; + } + if (cq->comps[info.comp_idx].status == QUEUED || test_bit(SDMA_REQ_IN_USE, &pq->reqs[info.comp_idx].flags)) { hfi1_cdbg(SDMA, "[%u:%u:%u] Entry %u is in QUEUED state", |