Commit:     9ed87fd34c97a998e63505718ce7e107a23c84c3
Parent:     4187b915a0f7eaa69707715e80d9fc253ff6167a
Author:     Jack Morgenstein <[EMAIL PROTECTED]>
AuthorDate: Tue Nov 20 13:01:28 2007 -0800
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Tue Nov 20 13:01:28 2007 -0800

    mlx4_core: Fix state check in mlx4_qp_modify()
    When checking the states passed in, mlx4_qp_modify() accidentally checks
    cur_state twice rather than checking cur_state and new_state.  Fix this
    to make sure that both values are in-bounds.
    Since these values may be passed in from userspace, this bug results in
    userspace being able to trigger an oops.
    Signed-off-by: Jack Morgenstein <[EMAIL PROTECTED]>
    Cc: stable <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
 drivers/net/mlx4/qp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c
index 42b4763..fa24e65 100644
--- a/drivers/net/mlx4/qp.c
+++ b/drivers/net/mlx4/qp.c
@@ -113,7 +113,7 @@ int mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt 
        struct mlx4_cmd_mailbox *mailbox;
        int ret = 0;
-       if (cur_state >= MLX4_QP_NUM_STATE || cur_state >= MLX4_QP_NUM_STATE ||
+       if (cur_state >= MLX4_QP_NUM_STATE || new_state >= MLX4_QP_NUM_STATE ||
                return -EINVAL;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to