Commit 6512f11d authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Jason Gunthorpe
Browse files

RDMA/mlx5: Return an error if copy_to_user fails 

In theoretical event, the ib_copy_to_udata() can fail, so return -EFAULT
error to the user, so he will destroy the QP.

Fixes: 50aec2c3 ("RDMA/mlx5: Return ECE data after modify QP")
Link: https://lore.kernel.org/r/20200602125548.172654-2-leon@kernel.org


Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 193ba031

drivers/infiniband/hw/mlx5/qp.c

+2 −6
Original line number Diff line number Diff line
@@ -4305,12 +4305,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, 
	/* resp.response_length is set in ECE supported flows only */

	if (!err && resp.response_length &&

	    udata->outlen >= resp.response_length)

		/*

		 * We don't check return value of the function below

		 * on purpose, because it is unclear how to unwind the

		 * error flow after QP was modified to the new state.

		 */

		ib_copy_to_udata(udata, &resp, resp.response_length);

		/* Return -EFAULT to the user and expect him to destroy QP. */

		err = ib_copy_to_udata(udata, &resp, resp.response_length);



out:

	mutex_unlock(&qp->mutex);