Gitweb: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ed87fd34c97a998e63505718ce7e107a23c84c3 Commit: 9ed87fd34c97a998e63505718ce7e107a23c84c3 Parent: 4187b915a0f7eaa69707715e80d9fc253ff6167a Author: Jack Morgenstein <[EMAIL PROTECTED]> AuthorDate: Tue Nov 20 13:01:28 2007 -0800 Committer: Roland Dreier <[EMAIL PROTECTED]> CommitDate: Tue Nov 20 13:01:28 2007 -0800
mlx4_core: Fix state check in mlx4_qp_modify() When checking the states passed in, mlx4_qp_modify() accidentally checks cur_state twice rather than checking cur_state and new_state. Fix this to make sure that both values are in-bounds. Since these values may be passed in from userspace, this bug results in userspace being able to trigger an oops. Signed-off-by: Jack Morgenstein <[EMAIL PROTECTED]> Cc: stable <[EMAIL PROTECTED]> Signed-off-by: Roland Dreier <[EMAIL PROTECTED]> --- drivers/net/mlx4/qp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c index 42b4763..fa24e65 100644 --- a/drivers/net/mlx4/qp.c +++ b/drivers/net/mlx4/qp.c @@ -113,7 +113,7 @@ int mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt *mtt, struct mlx4_cmd_mailbox *mailbox; int ret = 0; - if (cur_state >= MLX4_QP_NUM_STATE || cur_state >= MLX4_QP_NUM_STATE || + if (cur_state >= MLX4_QP_NUM_STATE || new_state >= MLX4_QP_NUM_STATE || !op[cur_state][new_state]) return -EINVAL; - To unsubscribe from this list: send the line "unsubscribe git-commits-head" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html