diff options
| author | Linus Walleij | 2018-03-18 17:48:59 +0100 |
|---|---|---|
| committer | Linus Walleij | 2018-03-18 17:48:59 +0100 |
| commit | 95260c17b27e4bdacf85022e629fb701b42cc190 (patch) | |
| tree | cfc6963180d99e5f36752ca028821aaa109e860d /drivers/infiniband/hw/mlx5/cq.c | |
| parent | gpio: mockup: Update Bamvors mail address (diff) | |
| parent | Linux 4.16-rc5 (diff) | |
| download | kernel-qcow2-linux-95260c17b27e4bdacf85022e629fb701b42cc190.tar.gz kernel-qcow2-linux-95260c17b27e4bdacf85022e629fb701b42cc190.tar.xz kernel-qcow2-linux-95260c17b27e4bdacf85022e629fb701b42cc190.zip | |
Merge tag 'v4.16-rc5' into devel
Linux 4.16-rc5 merged into the GPIO devel branch to resolve
a nasty conflict between fixes and devel in the RCAR driver.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers/infiniband/hw/mlx5/cq.c')
| -rw-r--r-- | drivers/infiniband/hw/mlx5/cq.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c index 5b974fb97611..15457c9569a7 100644 --- a/drivers/infiniband/hw/mlx5/cq.c +++ b/drivers/infiniband/hw/mlx5/cq.c @@ -226,7 +226,6 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, wc->ex.invalidate_rkey = be32_to_cpu(cqe->imm_inval_pkey); break; } - wc->slid = be16_to_cpu(cqe->slid); wc->src_qp = be32_to_cpu(cqe->flags_rqpn) & 0xffffff; wc->dlid_path_bits = cqe->ml_path; g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3; @@ -241,10 +240,12 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, } if (ll != IB_LINK_LAYER_ETHERNET) { + wc->slid = be16_to_cpu(cqe->slid); wc->sl = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0xf; return; } + wc->slid = 0; vlan_present = cqe->l4_l3_hdr_type & 0x1; roce_packet_type = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0x3; if (vlan_present) { @@ -1177,7 +1178,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, if (ucmd.reserved0 || ucmd.reserved1) return -EINVAL; - umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size, + /* check multiplication overflow */ + if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1) + return -EINVAL; + + umem = ib_umem_get(context, ucmd.buf_addr, + (size_t)ucmd.cqe_size * entries, IB_ACCESS_LOCAL_WRITE, 1); if (IS_ERR(umem)) { err = PTR_ERR(umem); |