IB/ipath: do not allow use of CQ entries with invalid counts

Signed-off-by: Bryan O'Sullivan <bryan.osullivan@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c
index 3c4c198a4514af1f870f28b98a9dd34fa85176c0..049221bc590e0eda2c2c743eca6da06af88a0259 100644 (file)
--- a/drivers/infiniband/hw/ipath/ipath_cq.c
+++ b/drivers/infiniband/hw/ipath/ipath_cq.c
@@ -172,7 +172,7 @@ struct ib_cq *ipath_create_cq(struct ib_device *ibdev, int entries,
        struct ipath_cq_wc *wc;
        struct ib_cq *ret;
 
-       if (entries > ib_ipath_max_cqes) {
+       if (entries < 1 || entries > ib_ipath_max_cqes) {
                ret = ERR_PTR(-EINVAL);
                goto done;
        }
@@ -324,6 +324,11 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
        u32 head, tail, n;
        int ret;
 
+       if (cqe < 1 || cqe > ib_ipath_max_cqes) {
+               ret = -EINVAL;
+               goto bail;
+       }
+
        /*
         * Need to use vmalloc() if we want to support large #s of entries.
         */