Commit 08e74c4b authored Mar 10, 2014 by Yann Droneaud Committed by Roland Dreier Apr 01, 2014

IB/mthca: Return an error on ib_copy_to_udata() failure

In case of error when writing to userspace, the function mthca_create_cq()
does not set an error code before following its error path.

This patch sets the error code to -EFAULT when ib_copy_to_udata() fails.

This was caught when using spatch (aka. coccinelle)
to rewrite call to ib_copy_{from,to}_udata().

Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com

Cc: <stable@vger.kernel.org>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

parent cfbf8d48

drivers/infiniband/hw/mthca/mthca_provider.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -695,6 +695,7 @@ static struct ib_cq mthca_create_cq(struct ib_device ibdev, int entries,

	if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) {		if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) {
	mthca_free_cq(to_mdev(ibdev), cq);		mthca_free_cq(to_mdev(ibdev), cq);
			err = -EFAULT;
	goto err_free;		goto err_free;
	}		}