diff options
| author | Roland Dreier <rolandd@cisco.com> | 2005-07-25 22:33:57 +0000 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2006-11-09 19:57:02 -0800 |
| commit | fed2d36ee0529ae60507565c485d21f8e05a253f (patch) | |
| tree | a2bd181216cb0f07f8bacd1d09e7b7d8d71247de | |
| parent | 017b7b0c221cd1ef3d61cc8252df107af16e1e85 (diff) | |
| download | libmthca-fed2d36ee0529ae60507565c485d21f8e05a253f.tar.gz | |
Sanity check QP sizes
Sanity check QP sizes passed into create_qp() to avoid problems caused
by overflows.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | src/verbs.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/verbs.c b/src/verbs.c index 0bc7baa..9addccc 100644 --- a/src/verbs.c +++ b/src/verbs.c @@ -284,6 +284,14 @@ struct ibv_qp *mthca_create_qp(struct ibv_pd *pd, struct ibv_qp_init_attr *attr) struct mthca_qp *qp; int ret; + /* Sanity check QP size before proceeding */ + if (attr->cap.max_send_wr > 65536 || + attr->cap.max_recv_wr > 65536 || + attr->cap.max_send_sge > 64 || + attr->cap.max_recv_sge > 64 || + attr->cap.max_inline_data > 1024) + return NULL; + qp = malloc(sizeof *qp); if (!qp) return NULL; |