Merge branch 'stable-3.2' into pandora-3.2

[pandora-kernel.git] / drivers / infiniband / core / uverbs_cmd.c

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 7f2254e..29c01fc 100644 (file)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1192,7 +1192,7 @@ ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file,
                            int out_len)
 {
        struct ib_uverbs_resize_cq      cmd;
-       struct ib_uverbs_resize_cq_resp resp;
+       struct ib_uverbs_resize_cq_resp resp = {};
        struct ib_udata                 udata;
        struct ib_cq                    *cq;
        int                             ret = -EINVAL;
@@ -1790,6 +1790,12 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
                goto out;
        }
 
+       if ((cmd.attr_mask & IB_QP_PORT) &&
+           !rdma_is_port_valid(qp->device, cmd.port_num)) {
+               ret = -EINVAL;
+               goto release_qp;
+       }
+
        attr->qp_state            = cmd.qp_state;
        attr->cur_qp_state        = cmd.cur_qp_state;
        attr->path_mtu            = cmd.path_mtu;
@@ -1843,6 +1849,7 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
                ret = ib_modify_qp(qp, attr, modify_qp_mask(qp->qp_type, cmd.attr_mask));
        }
 
+release_qp:
        put_qp_read(qp);
 
        if (ret)
@@ -2262,6 +2269,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
                            const char __user *buf, int in_len,
                            int out_len)
 {
+       struct ib_device                *ib_dev = file->device->ib_dev;
        struct ib_uverbs_create_ah       cmd;
        struct ib_uverbs_create_ah_resp  resp;
        struct ib_uobject               *uobj;
@@ -2276,6 +2284,9 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
 
+       if (!rdma_is_port_valid(ib_dev, cmd.attr.port_num))
+               return -EINVAL;
+
        uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
        if (!uobj)
                return -ENOMEM;