|
@@ -1383,8 +1383,9 @@ static int create_qp(struct ib_uverbs_file *file,
|
|
|
attr.rwq_ind_tbl = ind_tbl;
|
|
|
}
|
|
|
|
|
|
- if ((cmd_sz >= offsetof(typeof(*cmd), reserved1) +
|
|
|
- sizeof(cmd->reserved1)) && cmd->reserved1) {
|
|
|
+ if (cmd_sz > sizeof(*cmd) &&
|
|
|
+ !ib_is_udata_cleared(ucore, sizeof(*cmd),
|
|
|
+ cmd_sz - sizeof(*cmd))) {
|
|
|
ret = -EOPNOTSUPP;
|
|
|
goto err_put;
|
|
|
}
|
|
@@ -1482,11 +1483,21 @@ static int create_qp(struct ib_uverbs_file *file,
|
|
|
IB_QP_CREATE_MANAGED_SEND |
|
|
|
IB_QP_CREATE_MANAGED_RECV |
|
|
|
IB_QP_CREATE_SCATTER_FCS |
|
|
|
- IB_QP_CREATE_CVLAN_STRIPPING)) {
|
|
|
+ IB_QP_CREATE_CVLAN_STRIPPING |
|
|
|
+ IB_QP_CREATE_SOURCE_QPN)) {
|
|
|
ret = -EINVAL;
|
|
|
goto err_put;
|
|
|
}
|
|
|
|
|
|
+ if (attr.create_flags & IB_QP_CREATE_SOURCE_QPN) {
|
|
|
+ if (!capable(CAP_NET_RAW)) {
|
|
|
+ ret = -EPERM;
|
|
|
+ goto err_put;
|
|
|
+ }
|
|
|
+
|
|
|
+ attr.source_qpn = cmd->source_qpn;
|
|
|
+ }
|
|
|
+
|
|
|
buf = (void *)cmd + sizeof(*cmd);
|
|
|
if (cmd_sz > sizeof(*cmd))
|
|
|
if (!(buf[0] == 0 && !memcmp(buf, buf + 1,
|