From 0cee3acab27a45e9b46f4f8a4edf6e7ab4ade1ef Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Tue, 3 Mar 2026 15:50:07 -0400 Subject: [PATCH] RDMA/bnxt_re: Add missing comp_mask validation Two existing req driver data structures have comp_mask but nothing checks them for valid contents. Add the missing checks. Link: https://patch.msgid.link/r/10-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index 6d751febb28c8..412b99658d907 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -1693,7 +1693,7 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr, uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx); if (udata) { - rc = ib_copy_validate_udata_in(udata, ureq, qp_handle); + rc = ib_copy_validate_udata_in_cm(udata, ureq, qp_handle, 0); if (rc) return rc; } @@ -4471,7 +4471,10 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata) resp.comp_mask |= BNXT_RE_UCNTX_CMASK_QP_RATE_LIMIT_ENABLED; if (udata->inlen) { - rc = ib_copy_validate_udata_in(udata, ureq, comp_mask); + rc = ib_copy_validate_udata_in_cm( + udata, ureq, comp_mask, + BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT | + BNXT_RE_COMP_MASK_REQ_UCNTX_VAR_WQE_SUPPORT); if (rc) goto cfail; if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) { -- 2.47.3