From: Eli Cohen <eli@dev.mellanox.co.il>
Date: Wed, 23 Oct 2013 06:53:15 +0000 (+0300)
Subject: IB/mlx5: Fix overflow check in IB_WR_FAST_REG_MR
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=9641b74ebee65320fa52172995d6df12b641caa5;p=linux-beck.git

IB/mlx5: Fix overflow check in IB_WR_FAST_REG_MR

Make sure not to overflow when reading the page list from struct
ib_fast_reg_page_list.

Signed-off-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
---

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index e3881433f5d7..8a36fd78c89f 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1915,6 +1915,10 @@ static int set_frwr_li_wr(void **seg, struct ib_send_wr *wr, int *size,
 	if (unlikely((*seg == qp->sq.qend)))
 		*seg = mlx5_get_send_wqe(qp, 0);
 	if (!li) {
+		if (unlikely(wr->wr.fast_reg.page_list_len >
+			     wr->wr.fast_reg.page_list->max_page_list_len))
+			return	-ENOMEM;
+
 		set_frwr_pages(*seg, wr, mdev, pd, writ);
 		*seg += sizeof(struct mlx5_wqe_data_seg);
 		*size += (sizeof(struct mlx5_wqe_data_seg) / 16);