IB/ipath: Fix possible data corruption if multiple SGEs used for receive
authorRalph Campbell <ralph.campbell@qlogic.com>
Mon, 18 Jun 2007 21:24:44 +0000 (14:24 -0700)
committerRoland Dreier <rolandd@cisco.com>
Tue, 10 Jul 2007 03:12:26 +0000 (20:12 -0700)
commit30d149ab58cc3ed8e4bc9c4dc45bebbed0e84b6e
treef85f47458efb9e98f01b490a539dbf873bbaddd9
parentdb5518cd09c21f0fa70af0a4ca38badd90622c9e
IB/ipath: Fix possible data corruption if multiple SGEs used for receive

The code to copy data from the receive queue buffers to the IB SGEs
doesn't check the SGE length, only the memory region/page length when
copying data.  This could overwrite parts of the user's memory that
were not intended to be written.  It can only happen if multiple SGEs
are used to describe a receive buffer which almost never happens in
practice.

Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/hw/ipath/ipath_ruc.c
drivers/infiniband/hw/ipath/ipath_ud.c
drivers/infiniband/hw/ipath/ipath_verbs.c