[PATCH 08/10] RDMA/bnxt_re: Add missing comp_mask validation

Jason Gunthorpe
2026-02-06T01:45:51Z

Two existing req driver data structures have comp_mask but nothing
checks them for valid contents. Add the missing checks.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 485785fad1df63..6ea03e1f6c23dd 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1671,7 +1671,7 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,

uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
if (udata) {
- rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
+ rc = ib_copy_validate_udata_in_cm(udata, ureq, qp_handle, 0);
if (rc)
return rc;
}
@@ -4431,7 +4431,10 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;

if (udata->inlen) {
- rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
+ rc = ib_copy_validate_udata_in_cm(
+ udata, ureq, comp_mask,
+ BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT |
+ BNXT_RE_COMP_MASK_REQ_UCNTX_VAR_WQE_SUPPORT);
if (rc)
goto cfail;
if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {
--
2.43.0