korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-19 18:24:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

RDMA/mlx5: Return an error if copy_to_user fails

Browse Source 
In theoretical event, the ib_copy_to_udata() can fail, so return -EFAULT
error to the user, so he will destroy the QP.

Fixes: 50aec2c313 ("RDMA/mlx5: Return ECE data after modify QP")
Link: https://lore.kernel.org/r/20200602125548.172654-2-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Leon Romanovsky 2020-06-02 15:55:46 +03:00 committed by Jason Gunthorpe
parent 193ba03141
commit 6512f11d38
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/infiniband/hw/mlx5/qp.c
View File

@ -4305,12 +4305,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
/* resp.response_length is set in ECE supported flows only */
if (!err && resp.response_length &&
udata->outlen >= resp.response_length)
/*
* We don't check return value of the function below
* on purpose, because it is unclear how to unwind the
* error flow after QP was modified to the new state.
*/
ib_copy_to_udata(udata, &resp, resp.response_length);
/* Return -EFAULT to the user and expect him to destroy QP. */
err = ib_copy_to_udata(udata, &resp, resp.response_length);
out:
mutex_unlock(&qp->mutex);