We should also check the range of opcode after calling
__rdmap_get_opcode() in the else branch to prevent potential
overflow.

Fixes: 8b6a361b8c482 ("rdma/siw: receive path")
Signed-off-by: Dinghao Liu <dinghao....@zju.edu.cn>
---
 drivers/infiniband/sw/siw/siw_qp_rx.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c 
b/drivers/infiniband/sw/siw/siw_qp_rx.c
index 60116f20653c..301e7fe2c61a 100644
--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
@@ -1072,6 +1072,16 @@ static int siw_get_hdr(struct siw_rx_stream *srx)
                siw_dbg_qp(rx_qp(srx), "new header, opcode %u\n", opcode);
        } else {
                opcode = __rdmap_get_opcode(c_hdr);
+
+               if (opcode > RDMAP_TERMINATE) {
+                       pr_warn("siw: received unknown packet type %u\n",
+                               opcode);
+
+                       siw_init_terminate(rx_qp(srx), TERM_ERROR_LAYER_RDMAP,
+                                          RDMAP_ETYPE_REMOTE_OPERATION,
+                                          RDMAP_ECODE_OPCODE, 0);
+                       return -EINVAL;
+               }
        }
        set_rx_fpdu_context(qp, opcode);
        frx = qp->rx_fpdu;
-- 
2.17.1

Reply via email to