Commit 845127ed authored by Dean Luick's avatar Dean Luick Committed by Leon Romanovsky
Browse files

IB/hfi1: Improve TID validity checking 



Correct and improve validity checking of user supplied TIDs.
A tidctrl value of 0 is invalid.  Verify that the final
index is in range, not an intermediate value.

Signed-off-by: default avatarDean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Link: https://lore.kernel.org/r/167329105916.1472990.9915542468337924727.stgit@awfm-02.cornelisnetworks.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent d8f4ab01

drivers/infiniband/hw/hfi1/user_exp_rcv.c

+8 −8
Original line number Diff line number Diff line
@@ -741,20 +741,20 @@ static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, 
	struct hfi1_ctxtdata *uctxt = fd->uctxt;

	struct hfi1_devdata *dd = uctxt->dd;

	struct tid_rb_node *node;

	u8 tidctrl = EXP_TID_GET(tidinfo, CTRL);

	u32 tidctrl = EXP_TID_GET(tidinfo, CTRL);

	u32 tididx = EXP_TID_GET(tidinfo, IDX) << 1, rcventry;



	if (tididx >= uctxt->expected_count) {

		dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n",

			   tididx, uctxt->ctxt);

		return -EINVAL;

	}



	if (tidctrl == 0x3)

	if (tidctrl == 0x3 || tidctrl == 0x0)

		return -EINVAL;



	rcventry = tididx + (tidctrl - 1);



	if (rcventry >= uctxt->expected_count) {

		dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n",

			   rcventry, uctxt->ctxt);

		return -EINVAL;

	}



	node = fd->entry_to_rb[rcventry];

	if (!node || node->rcventry != (uctxt->expected_base + rcventry))

		return -EBADF;