9ed87fd34c
When checking the states passed in, mlx4_qp_modify() accidentally checks cur_state twice rather than checking cur_state and new_state. Fix this to make sure that both values are in-bounds. Since these values may be passed in from userspace, this bug results in userspace being able to trigger an oops. Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Cc: stable <stable@kernel.org> Signed-off-by: Roland Dreier <rolandd@cisco.com> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| alloc.c | ||
| catas.c | ||
| cmd.c | ||
| cq.c | ||
| eq.c | ||
| fw.c | ||
| fw.h | ||
| icm.c | ||
| icm.h | ||
| intf.c | ||
| main.c | ||
| mcg.c | ||
| mlx4.h | ||
| mr.c | ||
| pd.c | ||
| profile.c | ||
| qp.c | ||
| reset.c | ||
| srq.c | ||