[PATCH rdma-core 2/2] providers/irdma: Validate input before memory window bind

[Sindhu Devale <sindhu.devale@xxxxxxxxx>]

From: "Sindhu, Devale" <sindhu.devale@xxxxxxxxx>

Check for a non null MR, address and length
before allowing bind operation.

Also, add check to make sure the MR and MW are in
same PD before posting a bind MW op.

Fixes: 14a0fc824f16 ("rdma-core/irdma: Implement device supported verb APIs")
Signed-off-by: Sindhu, Devale <sindhu.devale@xxxxxxxxx>
---
 providers/irdma/uverbs.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/providers/irdma/uverbs.c b/providers/irdma/uverbs.c
index c8222d14..dc7cf41a 100644
--- a/providers/irdma/uverbs.c
+++ b/providers/irdma/uverbs.c
@@ -206,19 +206,30 @@ int irdma_ubind_mw(struct ibv_qp *qp, struct ibv_mw *mw,
 		   struct ibv_mw_bind *mw_bind)
 {
 	struct ibv_mw_bind_info	*bind_info = &mw_bind->bind_info;
-	struct verbs_mr *vmr = verbs_get_mr(bind_info->mr);
-	struct irdma_umr *umr = container_of(vmr, struct irdma_umr, vmr);
+	struct verbs_mr *vmr;
+	struct irdma_umr *umr;
 
 	struct ibv_send_wr wr = {};
 	struct ibv_send_wr *bad_wr;
 	int err;
 
-	if (vmr->mr_type != IBV_MR_TYPE_MR || mw->type != IBV_MW_TYPE_1)
-		return ENOTSUP;
-
-	if (umr->acc_flags & IBV_ACCESS_ZERO_BASED)
+	if (!bind_info->mr && (bind_info->addr || bind_info->length))
 		return EINVAL;
 
+	if (bind_info->mr) {
+		vmr = verbs_get_mr(bind_info->mr);
+		umr = container_of(vmr, struct irdma_umr, vmr);
+
+		if (vmr->mr_type != IBV_MR_TYPE_MR || mw->type != IBV_MW_TYPE_1)
+			return ENOTSUP;
+
+		if (umr->acc_flags & IBV_ACCESS_ZERO_BASED)
+			return EINVAL;
+
+		if (mw->pd != bind_info->mr->pd)
+			return EPERM;
+	}
+
 	wr.opcode = IBV_WR_BIND_MW;
 	wr.bind_mw.bind_info = mw_bind->bind_info;
 	wr.bind_mw.mw = mw;
-- 
2.32.0