Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ed87fd34c97a998e63505718ce7e107a23c84c3
Commit: 9ed87fd34c97a998e63505718ce7e107a23c84c3
Parent: 4187b915a0f7eaa69707715e80d9fc253ff6167a
Author: Jack Morgenstein <[EMAIL PROTECTED]>
AuthorDate: Tue Nov 20 13:01:28 2007 -0800
Committer: Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Tue Nov 20 13:01:28 2007 -0800
mlx4_core: Fix state check in mlx4_qp_modify()
When checking the states passed in, mlx4_qp_modify() accidentally checks
cur_state twice rather than checking cur_state and new_state. Fix this
to make sure that both values are in-bounds.
Since these values may be passed in from userspace, this bug results in
userspace being able to trigger an oops.
Signed-off-by: Jack Morgenstein <[EMAIL PROTECTED]>
Cc: stable <[EMAIL PROTECTED]>
Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
---
drivers/net/mlx4/qp.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c
index 42b4763..fa24e65 100644
--- a/drivers/net/mlx4/qp.c
+++ b/drivers/net/mlx4/qp.c
@@ -113,7 +113,7 @@ int mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt
*mtt,
struct mlx4_cmd_mailbox *mailbox;
int ret = 0;
- if (cur_state >= MLX4_QP_NUM_STATE || cur_state >= MLX4_QP_NUM_STATE ||
+ if (cur_state >= MLX4_QP_NUM_STATE || new_state >= MLX4_QP_NUM_STATE ||
!op[cur_state][new_state])
return -EINVAL;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
