RDMA/mlx5: Fix definition of mlx5_ib_create_qp_resp

This structure is pushed down the ex and the non-ex path, so it needs to be
aligned to 8 bytes to go through ex without implicit padding.

Old user space will provide 4 bytes of resp on !ex and 8 bytes on ex, so
take the approach of just copying the minimum length.

New user space will consistently provide 8 bytes in both cases.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index c152c6f35101b299c77ae048bd82707a76cd6f9a..c8f01f32ebb43118182ebca9ab5f96666631c922 100644 (file)
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -880,7 +880,7 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                goto err_free;
        }
 
-       err = ib_copy_to_udata(udata, resp, sizeof(*resp));
+       err = ib_copy_to_udata(udata, resp, min(udata->outlen, sizeof(*resp)));
        if (err) {
                mlx5_ib_dbg(dev, "copy failed\n");
                goto err_unmap;
@@ -1468,7 +1468,7 @@ static int create_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                return -EOPNOTSUPP;
        }
 
-       err = ib_copy_to_udata(udata, &resp, min_resp_len);
+       err = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
        if (err) {
                mlx5_ib_dbg(dev, "copy failed\n");
                return -EINVAL;

diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index 09c50f390a3c86834729a15daefdc00dac3ab301..f7d18fb017718bf76ecc7ec70df24f34e54d225e 100644 (file)
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -335,6 +335,7 @@ struct mlx5_ib_create_qp_rss {
 
 struct mlx5_ib_create_qp_resp {
        __u32   bfreg_index;
+       __u32   reserved;
 };
 
 struct mlx5_ib_alloc_mw {