From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:47532 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753560AbcKUQb7 (ORCPT ); Mon, 21 Nov 2016 11:31:59 -0500 Subject: Patch "IB/mlx5: Validate requested RQT size" has been added to the 4.8-stable tree To: maorg@mellanox.com, dledford@redhat.com, gregkh@linuxfoundation.org, leon@kernel.org, yishaih@mellanox.com Cc: , From: Date: Mon, 21 Nov 2016 17:29:34 +0100 Message-ID: <1479745774228172@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled IB/mlx5: Validate requested RQT size to the 4.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ib-mlx5-validate-requested-rqt-size.patch and it can be found in the queue-4.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From efd7f40082a0dfd112eb87ff2124467a5739216f Mon Sep 17 00:00:00 2001 From: Maor Gottlieb Date: Thu, 27 Oct 2016 16:36:40 +0300 Subject: IB/mlx5: Validate requested RQT size From: Maor Gottlieb commit efd7f40082a0dfd112eb87ff2124467a5739216f upstream. Validate that the requested size of RQT is supported by firmware. Fixes: c5f9092936fe ('IB/mlx5: Add Receive Work Queue Indirection table operations') Signed-off-by: Maor Gottlieb Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/mlx5/qp.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -4702,6 +4702,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_ udata->inlen)) return ERR_PTR(-EOPNOTSUPP); + if (init_attr->log_ind_tbl_size > + MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) { + mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n", + init_attr->log_ind_tbl_size, + MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)); + return ERR_PTR(-EINVAL); + } + min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved); if (udata->outlen && udata->outlen < min_resp_len) return ERR_PTR(-EINVAL); Patches currently in stable-queue which might be from maorg@mellanox.com are queue-4.8/ib-mlx5-validate-requested-rqt-size.patch queue-4.8/ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch queue-4.8/ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch queue-4.8/ib-mlx5-fix-memory-leak-in-query-device.patch queue-4.8/ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch queue-4.8/ib-mlx5-fix-fatal-error-dispatching.patch queue-4.8/ib-mlx5-fix-null-pointer-dereference-on-debug-print.patch