RDMA/hns: Add a check for current state before modifying QP

It should be considered an illegal operation if the ULP attempts to modify
a QP from another state to the current hardware state. Otherwise, the ULP
can modify some fields of QPC at any time. For example, for a QP in state
of RTS, modify it from RTR to RTS can change the PSN, which is always not
as expected.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/1598353674-24270-1-git-send-email-liweihang@huawei.com
Signed-off-by: Lang Cheng <chenglang@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index e94ca130ff5eb7fbfdcfc969d6f5a63057b7094e..bb87e5fc7e632adde6d0acd1bf1f5a68b3790219 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -1162,8 +1162,10 @@ int hns_roce_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 
        mutex_lock(&hr_qp->mutex);
 
-       cur_state = attr_mask & IB_QP_CUR_STATE ?
-                   attr->cur_qp_state : (enum ib_qp_state)hr_qp->state;
+       if (attr_mask & IB_QP_CUR_STATE && attr->cur_qp_state != hr_qp->state)
+               goto out;
+
+       cur_state = hr_qp->state;
        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
 
        if (ibqp->uobject &&