mthca/mlx4: add check to validate output data sizes

Only the hardware drivers know what size the output data buffer must be for ndi_modify_qp.  Have the drivers verify that the provided data buffer is large enough.

This fixes a crash if (say, a buggy) userspace (library under development) does not provide a response buffer.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
git-svn-id: svn://openib.tc.cornell.edu/gen1/trunk@1858 ad392aa1-c5ef-ae45-8dd8-e69d62a5ef86

diff --git a/hw/mlx4/kernel/hca/qp.c b/hw/mlx4/kernel/hca/qp.c
index 71d3169..2e7a16a 100644 (file)
--- a/hw/mlx4/kernel/hca/qp.c
+++ b/hw/mlx4/kernel/hca/qp.c
@@ -326,6 +326,11 @@ mlnx_ndi_modify_qp (
 \r
        HCA_ENTER(HCA_DBG_QP);\r
 \r
+       if (buf_size < sizeof(resp.qp_state)) {\r
+               status = IB_INVALID_PARAMETER;\r
+               goto out;\r
+       }\r
+\r
        /* imitate umv_buf */\r
        umv_buf.command = TRUE; /* special case for NDI. Usually it's TRUE */\r
        umv_buf.input_size = 0;\r
@@ -339,6 +344,7 @@ mlnx_ndi_modify_qp (
                *p_outbuf = resp.qp_state;\r
        }\r
 \r
+out:\r
        HCA_EXIT(HCA_DBG_QP);\r
        return status;\r
 }\r

diff --git a/hw/mthca/kernel/hca_verbs.c b/hw/mthca/kernel/hca_verbs.c
index 3bd5acc..ca3acf5 100644 (file)
--- a/hw/mthca/kernel/hca_verbs.c
+++ b/hw/mthca/kernel/hca_verbs.c
@@ -1266,6 +1266,11 @@ mlnx_ndi_modify_qp (
 \r
        HCA_ENTER(HCA_DBG_QP);\r
 \r
+       if (buf_size < sizeof(resp.qp_state)) {\r
+               status = IB_INVALID_PARAMETER;\r
+               goto out;\r
+       }\r
+\r
        /* imitate umv_buf */\r
        umv_buf.command = TRUE; /* special case for NDI. Usually it's TRUE */\r
        umv_buf.input_size = 0;\r
@@ -1279,6 +1284,7 @@ mlnx_ndi_modify_qp (
                *p_outbuf = resp.qp_state;\r
        }\r
 \r
+out:\r
        HCA_EXIT(HCA_DBG_QP);\r
        return status;\r
 }\r