diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-02-10 14:41:16 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-02-10 14:41:16 -0800 |
| commit | a9dbf5c8d4c90f54777f89daf0e34d390808b672 (patch) | |
| tree | a88262c9b95f6551d3d5baf89de0a9762e969253 /drivers | |
| parent | aca9fa0c8d225b1446dbed798b1d2f20e37e52cf (diff) | |
| parent | 646ebd4166ca00bdf682a36bd2e1c9a74d848ac6 (diff) | |
| download | linux-a9dbf5c8d4c90f54777f89daf0e34d390808b672.tar.bz2 | |
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma
Pull rdma fixes from Doug Ledford:
"Third round of -rc fixes for 4.10 kernel:
- two security related issues in the rxe driver
- one compile issue in the RDMA uapi header"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
RDMA: Don't reference kernel private header from UAPI header
IB/rxe: Fix mem_check_range integer overflow
IB/rxe: Fix resid update
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_mr.c | 8 | ||||
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_resp.c | 2 |
2 files changed, 6 insertions, 4 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index d0faca294006..86a6585b847d 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length) case RXE_MEM_TYPE_MR: case RXE_MEM_TYPE_FMR: - return ((iova < mem->iova) || - ((iova + length) > (mem->iova + mem->length))) ? - -EFAULT : 0; + if (iova < mem->iova || + length > mem->length || + iova > mem->iova + mem->length - length) + return -EFAULT; + return 0; default: return -EFAULT; diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 3435efff8799..5bcf07328972 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -479,7 +479,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp, goto err2; } - resid = mtu; + qp->resp.resid = mtu; } else { if (pktlen != resid) { state = RESPST_ERR_LENGTH; |