]> git.baikalelectronics.ru Git - kernel.git/commit
IB/core: Fix user mode post wr corruption
authorMike Marciniszyn <mike.marciniszyn@intel.com>
Tue, 1 Dec 2015 15:13:51 +0000 (10:13 -0500)
committerDoug Ledford <dledford@redhat.com>
Mon, 7 Dec 2015 21:22:14 +0000 (16:22 -0500)
commitd13e4bbf68ead28b857d9c50b22f039ac8abdda9
treebab111790d5f179664d016465780eaee8ae8fc9b
parent5b43e8fda1357927593d9050d6c58f19244d0582
IB/core: Fix user mode post wr corruption

Commit c1f5c7f55f79 ("IB: split struct ib_send_wr")
introduced a regression for HCAs whose user mode post
sends go through ib_uverbs_post_send().

The code didn't account for the fact that the first sge is
offset by an operation dependent length.  The allocation did,
but the pointer to the destination sge list is computed without
that knowledge.  The sge list copy_from_user() then corrupts
fields in the work request

Store the operation dependent length in a local variable and
compute the sge list copy_from_user() destination using that length.

Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/core/uverbs_cmd.c