The patch titled
IB/ipath: don't allow resources to be created with illegal values
has been added to the -mm tree. Its filename is
ib-ipath-dont-allow-resources-to-be-created-with.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: IB/ipath: don't allow resources to be created with illegal values
From: "Bryan O'Sullivan" <bos@xxxxxxxxxxxxx>
Signed-off-by: Robert Walsh <robert.walsh@xxxxxxxxxx>
Signed-off-by: Bryan O'Sullivan <bryan.osullivan@xxxxxxxxxx>
Cc: "Michael S. Tsirkin" <mst@xxxxxxxxxxxxxx>
Cc: Roland Dreier <rolandd@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/infiniband/hw/ipath/ipath_mr.c | 5 +++++
drivers/infiniband/hw/ipath/ipath_qp.c | 8 ++++++++
drivers/infiniband/hw/ipath/ipath_verbs.c | 11 +++++++++++
3 files changed, 24 insertions(+)
diff -puN drivers/infiniband/hw/ipath/ipath_mr.c~ib-ipath-dont-allow-resources-to-be-created-with drivers/infiniband/hw/ipath/ipath_mr.c
--- a/drivers/infiniband/hw/ipath/ipath_mr.c~ib-ipath-dont-allow-resources-to-be-created-with
+++ a/drivers/infiniband/hw/ipath/ipath_mr.c
@@ -170,6 +170,11 @@ struct ib_mr *ipath_reg_user_mr(struct i
int n, m, i;
struct ib_mr *ret;
+ if (region->length == 0) {
+ ret = ERR_PTR(-EINVAL);
+ goto bail;
+ }
+
n = 0;
list_for_each_entry(chunk, ®ion->chunk_list, list)
n += chunk->nents;
diff -puN drivers/infiniband/hw/ipath/ipath_qp.c~ib-ipath-dont-allow-resources-to-be-created-with drivers/infiniband/hw/ipath/ipath_qp.c
--- a/drivers/infiniband/hw/ipath/ipath_qp.c~ib-ipath-dont-allow-resources-to-be-created-with
+++ a/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -667,6 +667,14 @@ struct ib_qp *ipath_create_qp(struct ib_
goto bail;
}
+ if (init_attr->cap.max_send_sge +
+ init_attr->cap.max_recv_sge +
+ init_attr->cap.max_send_wr +
+ init_attr->cap.max_recv_wr == 0) {
+ ret = ERR_PTR(-EINVAL);
+ goto bail;
+ }
+
switch (init_attr->qp_type) {
case IB_QPT_UC:
case IB_QPT_RC:
diff -puN drivers/infiniband/hw/ipath/ipath_verbs.c~ib-ipath-dont-allow-resources-to-be-created-with drivers/infiniband/hw/ipath/ipath_verbs.c
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c~ib-ipath-dont-allow-resources-to-be-created-with
+++ a/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -792,6 +792,17 @@ static struct ib_ah *ipath_create_ah(str
goto bail;
}
+ if (ah_attr->dlid == 0) {
+ ret = ERR_PTR(-EINVAL);
+ goto bail;
+ }
+
+ if (ah_attr->port_num != 1 ||
+ ah_attr->port_num > pd->device->phys_port_cnt) {
+ ret = ERR_PTR(-EINVAL);
+ goto bail;
+ }
+
ah = kmalloc(sizeof *ah, GFP_ATOMIC);
if (!ah) {
ret = ERR_PTR(-ENOMEM);
_
Patches currently in -mm which might be from bos@xxxxxxxxxxxxx are
ib-ipath-name-zero-counter-offsets-so-its-clear.patch
ib-ipath-update-copyrights-and-other-strings-to.patch
ib-ipath-share-more-common-code-between-rc-and-uc.patch
ib-ipath-fix-an-indenting-problem.patch
ib-ipath-fix-shared-receive-queues-for-rc.patch
ib-ipath-allow-diags-on-any-unit.patch
ib-ipath-update-some-comments-and-fix-typos.patch
ib-ipath-remove-some-duplicate-code.patch
ib-ipath-dont-allow-resources-to-be-created-with.patch
ib-ipath-fix-some-memory-leaks-on-failure-paths.patch
ib-ipath-return-an-error-for-unknown-multicast-gid.patch
ib-ipath-report-correct-device-identification.patch
ib-ipath-enforce-device-resource-limits.patch
ib-ipath-removed-unused-field-ipath_kregvirt-from.patch
ib-ipath-print-better-debug-info-when-handling.patch
ib-ipath-enable-freeze-mode-when-shutting-down.patch
ib-ipath-use-more-appropriate-gfp-flags.patch
ib-ipath-use-vmalloc-to-allocate-struct.patch
ib-ipath-memory-management-cleanups.patch
ib-ipath-reduce-overhead-on-receive-interrupts.patch
ib-ipath-fixed-bug-9776.patch
ib-ipath-fix-lost-interrupts-on-ht-400.patch
ib-ipath-disallow-send-of-invalid-packet-sizes.patch
ib-ipath-dont-confuse-the-max-message-size-with.patch
ib-ipath-removed-redundant-statements.patch
ib-ipath-check-for-valid-lid-and-multicast-lids.patch
ib-ipath-fixes-to-performance-get-counters-for-ib.patch
ib-ipath-fixes-a-bug-where-our-delay-for-eeprom-no.patch
ib-ipath-rc-receive-interrupt-performance-changes.patch
ib-ipath-purge-sps_lid-and-sps_mlid-arrays.patch
ib-ipath-drop-the-stats-sysfs-attribute-group.patch
ib-ipath-support-more-models-of-infinipath-hardware.patch
ib-ipath-read-write-correct-sizes-through-diag.patch
ib-ipath-fix-a-bug-that-results-in-addresses-near.patch
ib-ipath-remove-some-if-0-code-related-to.patch
ib-ipath-ignore-receive-queue-size-if-srq-is.patch
ib-ipath-namespace-cleanup-replace-ips-with-ipath.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
