From: Dan Carpenter Date: Sat, 19 Oct 2013 09:14:12 +0000 (+0300) Subject: RDMA/cxgb4: Fix underflows in c4iw_create_qp() X-Git-Tag: v4.14-rc1~7775^2^2~17 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ff1706f4feb8e0e1a2e56a8dd57e17a4b45649b5;p=platform%2Fkernel%2Flinux-rpi.git RDMA/cxgb4: Fix underflows in c4iw_create_qp() These sizes should be unsigned so we don't allow negative values and have underflow bugs. These can come from the user so there may be security implications, but I have not tested this. Signed-off-by: Dan Carpenter Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c index 5829367..72ea152 100644 --- a/drivers/infiniband/hw/cxgb4/qp.c +++ b/drivers/infiniband/hw/cxgb4/qp.c @@ -1533,7 +1533,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs, struct c4iw_cq *schp; struct c4iw_cq *rchp; struct c4iw_create_qp_resp uresp; - int sqsize, rqsize; + unsigned int sqsize, rqsize; struct c4iw_ucontext *ucontext; int ret; struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4, *mm5 = NULL;