IB/hfi1: Improve TID validity checking

Correct and improve validity checking of user supplied TIDs.
A tidctrl value of 0 is invalid.  Verify that the final
index is in range, not an intermediate value.

Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Link: https://lore.kernel.org/r/167329105916.1472990.9915542468337924727.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
index b61c440..fbe48cd 100644 (file)
--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
@@ -741,20 +741,20 @@ static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo,
        struct hfi1_ctxtdata *uctxt = fd->uctxt;
        struct hfi1_devdata *dd = uctxt->dd;
        struct tid_rb_node *node;
-       u8 tidctrl = EXP_TID_GET(tidinfo, CTRL);
+       u32 tidctrl = EXP_TID_GET(tidinfo, CTRL);
        u32 tididx = EXP_TID_GET(tidinfo, IDX) << 1, rcventry;
 
-       if (tididx >= uctxt->expected_count) {
-               dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n",
-                          tididx, uctxt->ctxt);
-               return -EINVAL;
-       }
-
-       if (tidctrl == 0x3)
+       if (tidctrl == 0x3 || tidctrl == 0x0)
                return -EINVAL;
 
        rcventry = tididx + (tidctrl - 1);
 
+       if (rcventry >= uctxt->expected_count) {
+               dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n",
+                          rcventry, uctxt->ctxt);
+               return -EINVAL;
+       }
+
        node = fd->entry_to_rb[rcventry];
        if (!node || node->rcventry != (uctxt->expected_base + rcventry))
                return -EBADF;