RDMA/mlx5: Return an error if copy_to_user fails

In theoretical event, the ib_copy_to_udata() can fail, so return -EFAULT
error to the user, so he will destroy the QP.

Fixes: 50aec2c3135e ("RDMA/mlx5: Return ECE data after modify QP")
Link: https://lore.kernel.org/r/20200602125548.172654-2-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 9364a7a76ac294db9aa635e1b0c3e515d4b57c4e..9f0b7f1908dac0b9d64b906609e916a16d78bea4 100644 (file)
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -4305,12 +4305,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        /* resp.response_length is set in ECE supported flows only */
        if (!err && resp.response_length &&
            udata->outlen >= resp.response_length)
-               /*
-                * We don't check return value of the function below
-                * on purpose, because it is unclear how to unwind the
-                * error flow after QP was modified to the new state.
-                */
-               ib_copy_to_udata(udata, &resp, resp.response_length);
+               /* Return -EFAULT to the user and expect him to destroy QP. */
+               err = ib_copy_to_udata(udata, &resp, resp.response_length);
 
 out:
        mutex_unlock(&qp->mutex);