diff options
| author |   Michael J. Ruhl <michael.j.ruhl@intel.com> | 2018-09-28 07:34:57 -0700 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2018-09-30 19:21:11 -0600 |
| commit | 935c84ac649a147e1aad2c48ee5c5a1a9176b2d0 (patch) | |
| tree | b62ffae009b24f8062846900adede5cbb02c6d15 /drivers/infiniband/hw/hfi1/mad.c | |
| parent | IB/rxe: replace kvfree with vfree (diff) | |
| download | linux-dev-935c84ac649a147e1aad2c48ee5c5a1a9176b2d0.tar.xz linux-dev-935c84ac649a147e1aad2c48ee5c5a1a9176b2d0.zip | |
IB/hfi1: Error path MAD response size is incorrect
If a MAD packet has incorrect header information, the logic uses the reply
path to report the error. The reply path expects *resp_len to be set
prior to return. Unfortunately, *resp_len is set to 0 for this path.
This causes an incorrect response packet.
Fix by ensuring that the *resp_len is defaulted to the incoming packet
size (wc->bytes_len - sizeof(GRH)).
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/mad.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c index 0307405491e0..88a0cf930136 100644 --- a/drivers/infiniband/hw/hfi1/mad.c +++ b/drivers/infiniband/hw/hfi1/mad.c @@ -1,5 +1,5 @@ /* - * Copyright(c) 2015-2017 Intel Corporation. + * Copyright(c) 2015-2018 Intel Corporation. * * This file is provided under a dual BSD/GPLv2 license. When using or * redistributing this file, you may do so under either license. @@ -4836,7 +4836,7 @@ static int hfi1_process_opa_mad(struct ib_device *ibdev, int mad_flags, int ret; int pkey_idx; int local_mad = 0; - u32 resp_len = 0; + u32 resp_len = in_wc->byte_len - sizeof(*in_grh); struct hfi1_ibport *ibp = to_iport(ibdev, port); pkey_idx = hfi1_lookup_pkey_idx(ibp, LIM_MGMT_P_KEY); |