Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9641b74e authored by Eli Cohen's avatar Eli Cohen Committed by Roland Dreier
Browse files

IB/mlx5: Fix overflow check in IB_WR_FAST_REG_MR 



Make sure not to overflow when reading the page list from struct
ib_fast_reg_page_list.

Signed-off-by: default avatarEli Cohen <eli@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 746b5583

drivers/infiniband/hw/mlx5/qp.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -1915,6 +1915,10 @@ static int set_frwr_li_wr(void **seg, struct ib_send_wr *wr, int *size, 
	if (unlikely((*seg == qp->sq.qend)))

	if (unlikely((*seg == qp->sq.qend)))

		*seg = mlx5_get_send_wqe(qp, 0);

		*seg = mlx5_get_send_wqe(qp, 0);

	if (!li) {

	if (!li) {

		if (unlikely(wr->wr.fast_reg.page_list_len >

			     wr->wr.fast_reg.page_list->max_page_list_len))

			return	-ENOMEM;



		set_frwr_pages(*seg, wr, mdev, pd, writ);

		set_frwr_pages(*seg, wr, mdev, pd, writ);

		*seg += sizeof(struct mlx5_wqe_data_seg);

		*seg += sizeof(struct mlx5_wqe_data_seg);

		*size += (sizeof(struct mlx5_wqe_data_seg) / 16);

		*size += (sizeof(struct mlx5_wqe_data_seg) / 16);