IB/uverbs: Protect QP multicast list

[pandora-kernel.git] / drivers / infiniband / core / uverbs_cmd.c

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 254f164..e3db8ef 100644 (file)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
        return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
 }
 
+static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
+{
+       struct ib_uobject *uobj;
+
+       uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
+       return uobj ? uobj->object : NULL;
+}
+
 static void put_qp_read(struct ib_qp *qp)
 {
        put_uobj_read(qp->uobject);
 }
 
+static void put_qp_write(struct ib_qp *qp)
+{
+       put_uobj_write(qp->uobject);
+}
+
 static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
 {
        return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
@@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
 
-       qp = idr_read_qp(cmd.qp_handle, file->ucontext);
+       qp = idr_write_qp(cmd.qp_handle, file->ucontext);
        if (!qp)
                return -EINVAL;
 
@@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
                kfree(mcast);
 
 out_put:
-       put_qp_read(qp);
+       put_qp_write(qp);
 
        return ret ? ret : in_len;
 }
@@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
 
-       qp = idr_read_qp(cmd.qp_handle, file->ucontext);
+       qp = idr_write_qp(cmd.qp_handle, file->ucontext);
        if (!qp)
                return -EINVAL;
 
@@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
                }
 
 out_put:
-       put_qp_read(qp);
+       put_qp_write(qp);
 
        return ret ? ret : in_len;
 }