summaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorLeon Romanovsky <leonro@mellanox.com>2020-06-02 15:55:46 +0300
committerJason Gunthorpe <jgg@mellanox.com>2020-06-03 15:45:01 -0300
commit6512f11d386c7cf83a48e71cfd7c7c1b0003c151 (patch)
treefe97b032132c73bcdcad6318c3d64ecd86b43478 /drivers/infiniband
parent193ba03141bb987c3af985f6479840030fec0534 (diff)
downloadlinux-stable-6512f11d386c7cf83a48e71cfd7c7c1b0003c151.tar.gz
linux-stable-6512f11d386c7cf83a48e71cfd7c7c1b0003c151.tar.bz2
linux-stable-6512f11d386c7cf83a48e71cfd7c7c1b0003c151.zip
RDMA/mlx5: Return an error if copy_to_user fails
In theoretical event, the ib_copy_to_udata() can fail, so return -EFAULT error to the user, so he will destroy the QP. Fixes: 50aec2c3135e ("RDMA/mlx5: Return ECE data after modify QP") Link: https://lore.kernel.org/r/20200602125548.172654-2-leon@kernel.org Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/hw/mlx5/qp.c8
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 9364a7a76ac2..9f0b7f1908da 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -4305,12 +4305,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
/* resp.response_length is set in ECE supported flows only */
if (!err && resp.response_length &&
udata->outlen >= resp.response_length)
- /*
- * We don't check return value of the function below
- * on purpose, because it is unclear how to unwind the
- * error flow after QP was modified to the new state.
- */
- ib_copy_to_udata(udata, &resp, resp.response_length);
+ /* Return -EFAULT to the user and expect him to destroy QP. */
+ err = ib_copy_to_udata(udata, &resp, resp.response_length);
out:
mutex_unlock(&qp->mutex);