From: Leon Romanovsky Date: Tue, 2 Jun 2020 12:55:46 +0000 (+0300) Subject: RDMA/mlx5: Return an error if copy_to_user fails X-Git-Tag: v5.15~3685^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6512f11d386c7cf83a48e71cfd7c7c1b0003c151;p=platform%2Fkernel%2Flinux-starfive.git RDMA/mlx5: Return an error if copy_to_user fails In theoretical event, the ib_copy_to_udata() can fail, so return -EFAULT error to the user, so he will destroy the QP. Fixes: 50aec2c3135e ("RDMA/mlx5: Return ECE data after modify QP") Link: https://lore.kernel.org/r/20200602125548.172654-2-leon@kernel.org Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe --- diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index 9364a7a..9f0b7f1 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -4305,12 +4305,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, /* resp.response_length is set in ECE supported flows only */ if (!err && resp.response_length && udata->outlen >= resp.response_length) - /* - * We don't check return value of the function below - * on purpose, because it is unclear how to unwind the - * error flow after QP was modified to the new state. - */ - ib_copy_to_udata(udata, &resp, resp.response_length); + /* Return -EFAULT to the user and expect him to destroy QP. */ + err = ib_copy_to_udata(udata, &resp, resp.response_length); out: mutex_unlock(&qp->mutex);