RDMA/bnxt_re: Add missing comp_mask validation

Two existing req driver data structures have comp_mask but nothing
checks them for valid contents. Add the missing checks.

Link: https://patch.msgid.link/r/10-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com
Tested-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Acked-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 6d751febb28c8b8009b6319bb0cc21d1927036c5..412b99658d90732939bbeb0d4c8b9dc70d4cd310 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1693,7 +1693,7 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
 
        uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
        if (udata) {
-               rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
+               rc = ib_copy_validate_udata_in_cm(udata, ureq, qp_handle, 0);
                if (rc)
                        return rc;
        }
@@ -4471,7 +4471,10 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
                resp.comp_mask |= BNXT_RE_UCNTX_CMASK_QP_RATE_LIMIT_ENABLED;
 
        if (udata->inlen) {
-               rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
+               rc = ib_copy_validate_udata_in_cm(
+                       udata, ureq, comp_mask,
+                       BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT |
+                               BNXT_RE_COMP_MASK_REQ_UCNTX_VAR_WQE_SUPPORT);
                if (rc)
                        goto cfail;
                if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {