diff options
| author | Jack Morgenstein <jackm@dev.mellanox.co.il> | 2007-11-20 22:01:28 +0100 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-11-20 22:01:28 +0100 |
| commit | 9ed87fd34c97a998e63505718ce7e107a23c84c3 (patch) | |
| tree | 137e38d8fed9a1b43f34f0ed009ff6ea048ac884 /drivers/infiniband | |
| parent | IB/ipath: Normalize error return codes for posting work requests (diff) | |
| download | linux-9ed87fd34c97a998e63505718ce7e107a23c84c3.tar.xz linux-9ed87fd34c97a998e63505718ce7e107a23c84c3.zip | |
mlx4_core: Fix state check in mlx4_qp_modify()
When checking the states passed in, mlx4_qp_modify() accidentally checks
cur_state twice rather than checking cur_state and new_state. Fix this
to make sure that both values are in-bounds.
Since these values may be passed in from userspace, this bug results in
userspace being able to trigger an oops.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Cc: stable <stable@kernel.org>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband')
0 files changed, 0 insertions, 0 deletions