From: Eli Cohen Date: Wed, 23 Oct 2013 06:53:15 +0000 (+0300) Subject: IB/mlx5: Fix overflow check in IB_WR_FAST_REG_MR X-Git-Tag: v3.13-rc1~44^2^7~14 X-Git-Url: http://git.cascardo.info/?a=commitdiff_plain;h=9641b74ebee65320fa52172995d6df12b641caa5;p=cascardo%2Flinux.git IB/mlx5: Fix overflow check in IB_WR_FAST_REG_MR Make sure not to overflow when reading the page list from struct ib_fast_reg_page_list. Signed-off-by: Eli Cohen Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index e3881433f5d7..8a36fd78c89f 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -1915,6 +1915,10 @@ static int set_frwr_li_wr(void **seg, struct ib_send_wr *wr, int *size, if (unlikely((*seg == qp->sq.qend))) *seg = mlx5_get_send_wqe(qp, 0); if (!li) { + if (unlikely(wr->wr.fast_reg.page_list_len > + wr->wr.fast_reg.page_list->max_page_list_len)) + return -ENOMEM; + set_frwr_pages(*seg, wr, mdev, pd, writ); *seg += sizeof(struct mlx5_wqe_data_seg); *size += (sizeof(struct mlx5_wqe_data_seg) / 16);