diff options
| -rw-r--r-- | src/drivers/infiniband/qib7322.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/src/drivers/infiniband/qib7322.c b/src/drivers/infiniband/qib7322.c index 3bd587ec0..af7006e04 100644 --- a/src/drivers/infiniband/qib7322.c +++ b/src/drivers/infiniband/qib7322.c @@ -1507,8 +1507,15 @@ static void qib7322_complete_recv ( struct ib_device *ibdev, /* Completing the eager buffer described in * this header entry. */ - iob_put ( iobuf, payload_len ); - rc = ( err ? -EIO : ( useegrbfr ? 0 : -ECANCELED ) ); + if ( payload_len <= iob_tailroom ( iobuf ) ) { + iob_put ( iobuf, payload_len ); + rc = ( err ? + -EIO : ( useegrbfr ? 0 : -ECANCELED ) ); + } else { + DBGC ( qib7322, "QIB7322 %p bad payload len " + "%zd\n", qib7322, payload_len ); + rc = -EPROTO; + } /* Redirect to target QP if necessary */ if ( qp != intended_qp ) { DBGC2 ( qib7322, "QIB7322 %p redirecting QPN " @@ -1519,7 +1526,7 @@ static void qib7322_complete_recv ( struct ib_device *ibdev, intended_qp->recv.fill++; } ib_complete_recv ( ibdev, intended_qp, &dest, &source, - iobuf, rc); + iobuf, rc ); } else { /* Completing on a skipped-over eager buffer */ ib_complete_recv ( ibdev, qp, &dest, &source, iobuf, |