diff options
author | Jack Morgenstein <jackm@dev.mellanox.co.il> | 2007-11-20 13:01:28 -0800 |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2007-11-20 13:01:28 -0800 |
commit | 9ed87fd34c97a998e63505718ce7e107a23c84c3 (patch) | |
tree | 137e38d8fed9a1b43f34f0ed009ff6ea048ac884 /drivers/infiniband/hw | |
parent | 4187b915a0f7eaa69707715e80d9fc253ff6167a (diff) | |
download | op-kernel-dev-9ed87fd34c97a998e63505718ce7e107a23c84c3.zip op-kernel-dev-9ed87fd34c97a998e63505718ce7e107a23c84c3.tar.gz |
mlx4_core: Fix state check in mlx4_qp_modify()
When checking the states passed in, mlx4_qp_modify() accidentally checks
cur_state twice rather than checking cur_state and new_state. Fix this
to make sure that both values are in-bounds.
Since these values may be passed in from userspace, this bug results in
userspace being able to trigger an oops.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Cc: stable <stable@kernel.org>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw')
0 files changed, 0 insertions, 0 deletions