Merge tag 'iio-for-4.8c' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio...

[deliverable/linux.git] / drivers / infiniband / core / uverbs_cmd.c

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6fdc7ecdaca0c3df64e471e9d7b4b3f8242f00ff..825021d1008b9a13ee5a3b02ed0a1dd7ce80d0ee 100644 (file)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1747,7 +1747,7 @@ static int create_qp(struct ib_uverbs_file *file,
        struct ib_srq                   *srq = NULL;
        struct ib_qp                    *qp;
        char                            *buf;
-       struct ib_qp_init_attr          attr;
+       struct ib_qp_init_attr          attr = {};
        struct ib_uverbs_ex_create_qp_resp resp;
        int                             ret;
 
@@ -1833,7 +1833,8 @@ static int create_qp(struct ib_uverbs_file *file,
        if (attr.create_flags & ~(IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK |
                                IB_QP_CREATE_CROSS_CHANNEL |
                                IB_QP_CREATE_MANAGED_SEND |
-                               IB_QP_CREATE_MANAGED_RECV)) {
+                               IB_QP_CREATE_MANAGED_RECV |
+                               IB_QP_CREATE_SCATTER_FCS)) {
                ret = -EINVAL;
                goto err_put;
        }
@@ -3088,8 +3089,7 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
        if (cmd.comp_mask)
                return -EINVAL;
 
-       if ((cmd.flow_attr.type == IB_FLOW_ATTR_SNIFFER &&
-            !capable(CAP_NET_ADMIN)) || !capable(CAP_NET_RAW))
+       if (!capable(CAP_NET_RAW))
                return -EPERM;
 
        if (cmd.flow_attr.flags >= IB_FLOW_ATTR_FLAGS_RESERVED)
@@ -3655,6 +3655,11 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
        resp.hca_core_clock = attr.hca_core_clock;
        resp.response_length += sizeof(resp.hca_core_clock);
 
+       if (ucore->outlen < resp.response_length + sizeof(resp.device_cap_flags_ex))
+               goto end;
+
+       resp.device_cap_flags_ex = attr.device_cap_flags;
+       resp.response_length += sizeof(resp.device_cap_flags_ex);
 end:
        err = ib_copy_to_udata(ucore, &resp, resp.response_length);
        return err;