diff options
| author | Dean Luick <dean.luick@cornelisnetworks.com> | 2023-01-09 22:04:19 +0300 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2023-01-10 13:52:35 +0300 |
| commit | 845127ed8717e0340c022ef1fd646ed4694d9c7b (patch) | |
| tree | 7ec16dd07e5816a0d982d3eb43fcae4d65c2243f /drivers/infiniband/hw/hfi1 | |
| parent | d8f4ab01c6d0d59f7010b27c3b4ffca512324457 (diff) | |
| download | linux-845127ed8717e0340c022ef1fd646ed4694d9c7b.tar.xz | |
IB/hfi1: Improve TID validity checking
Correct and improve validity checking of user supplied TIDs.
A tidctrl value of 0 is invalid. Verify that the final
index is in range, not an intermediate value.
Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Link: https://lore.kernel.org/r/167329105916.1472990.9915542468337924727.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/hw/hfi1')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/user_exp_rcv.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c index b61c440f7f06..fbe48cd23c9a 100644 --- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c +++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c @@ -741,20 +741,20 @@ static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, struct hfi1_ctxtdata *uctxt = fd->uctxt; struct hfi1_devdata *dd = uctxt->dd; struct tid_rb_node *node; - u8 tidctrl = EXP_TID_GET(tidinfo, CTRL); + u32 tidctrl = EXP_TID_GET(tidinfo, CTRL); u32 tididx = EXP_TID_GET(tidinfo, IDX) << 1, rcventry; - if (tididx >= uctxt->expected_count) { - dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n", - tididx, uctxt->ctxt); - return -EINVAL; - } - - if (tidctrl == 0x3) + if (tidctrl == 0x3 || tidctrl == 0x0) return -EINVAL; rcventry = tididx + (tidctrl - 1); + if (rcventry >= uctxt->expected_count) { + dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n", + rcventry, uctxt->ctxt); + return -EINVAL; + } + node = fd->entry_to_rb[rcventry]; if (!node || node->rcventry != (uctxt->expected_base + rcventry)) return -EBADF; |