IB/ipath: Check that a UD work request's address handle is valid

Signed-off-by: Bryan O'Sullivan <bryan.osullivan@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 57625b8c1b9..a518f7c8fa8 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -308,6 +308,11 @@ int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr)
                 goto bail;
         }
 
+        if (wr->wr.ud.ah->pd != qp->ibqp.pd) {
+                ret = -EPERM;
+                goto bail;
+        }
+
         /* IB spec says that num_sge == 0 is OK. */
         if (wr->num_sge > qp->s_max_sge) {
                 ret = -EINVAL;