Jack Morgenstein 9ed87fd34c mlx4_core: Fix state check in mlx4_qp_modify() ...

When checking the states passed in, mlx4_qp_modify() accidentally checks
cur_state twice rather than checking cur_state and new_state.  Fix this
to make sure that both values are in-bounds.

Since these values may be passed in from userspace, this bug results in
userspace being able to trigger an oops.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Cc: stable <stable@kernel.org>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

2007-11-20 13:01:28 -08:00

..

alloc.c

mlx4_core: Fix possible bad free in mlx4_buf_free()

2007-11-13 15:26:57 -08:00

catas.c

mlx4_core: Reset device when internal error is detected

2007-07-17 18:37:42 -07:00

cmd.c

mlx4_core: Use mmiowb() to avoid firmware commands getting jumbled up

2007-10-09 19:59:18 -07:00

cq.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00

eq.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00

fw.c

mlx4_core: Increase command timeout for INIT_HCA to 10 seconds

2007-10-21 15:06:04 -07:00

fw.h

mlx4_core: Get the maximum message size from reported device capabilities

2007-07-09 20:12:26 -07:00

icm.c

SG: Change sg_set_page() to take length and offset argument

2007-10-24 11:20:47 +02:00

icm.h

mlx4_core: Write MTTs from CPU instead with of WRITE_MTT FW command

2007-10-09 19:59:16 -07:00

intf.c

mlx4_core: Reset device when internal error is detected

2007-07-17 18:37:42 -07:00

main.c

mlx4_core: Fix infinite loop on device initialization

2007-10-13 14:10:50 -07:00

Makefile

IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters

2007-05-08 18:00:38 -07:00

mcg.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00

mlx4.h

mlx4_core: Increase max number of QPs per multicast group to 56

2007-10-09 19:59:16 -07:00

mr.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00

pd.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00

profile.c

IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters

2007-05-08 18:00:38 -07:00

qp.c

mlx4_core: Fix state check in mlx4_qp_modify()

2007-11-20 13:01:28 -08:00

reset.c

mlx4_core: Wait 1 second after reset before accessing device

2007-08-13 08:47:44 -07:00

srq.c

mlx4_core: Fix section mismatches

2007-10-10 15:43:54 -07:00