Re: [PATCH 2.6.37] RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error.

[Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>]

On 10/20/2010 5:41 PM, Hefty, Sean wrote:
> You have this check:
>
>>>> +		if (udata->outlen<   sizeof uresp) {
>>>> +			if (!warned++)
>>>> +				printk(KERN_WARNING MOD "Warning - "
>>>> +				       "downlevel libcxgb3 (non-fatal).\n");
>>>> +			mm->len = PAGE_ALIGN((1UL<<   uresp.size_log2) *
>>>> +					     sizeof(struct t3_cqe));
> then fall through to here:
>
>>>>    		if (ib_copy_to_udata(udata,&uresp, sizeof (uresp))) {
>
>> The only way it can be less is if the library is using the ABI 0 version
>> of the response struct.  Or am I missing something?
> To me, this looks like the buffer referenced by udata will be smaller than the size of the data being copied, which I expect would either fail, or the kernel will overwrite some unsuspecting user memory.

You're right: the ib_copy_to_udata() size needs to be adjusted 
accordingly.  Good catch.  Although the testing didn't cause any faults.



--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html