RDMA/cxgb4: underflows in c4iw_create_qp()

PATCH New Dan Carpenter 1 participant 1 message Oct 19, 2013

Subsystems (3)

Kernel janitors InfiniBand CXGB4 iWARP RNIC driver (IW_CXGB4)

lore

Share & tools

lore

Dan Carpenter

author

2013-10-19 09:14 UTC #0 lore raw

PATCH 1/1 RDMA/cxgb4: underflows in c4iw_create_qp()

These sizes should be unsigned so we don't allow negative values and have underflow bugs. These can come from the user so there may be security implications, but I have not tested this.

Signed-off-by Dan Carpenter <[email protected]>

drivers/infiniband/hw/cxgb4/qp.c +1 -1

index 5829367..72ea152 100644
@@ -1533,7 +1533,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 	struct c4iw_cq *schp;
 	struct c4iw_cq *rchp;
 	struct c4iw_create_qp_resp uresp;
-	int sqsize, rqsize;
+	unsigned int sqsize, rqsize;
 	struct c4iw_ucontext *ucontext;
 	int ret;
 	struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4, *mm5 = NULL;