mlx5: Fix check for SQ overflow in bind_mw

[ Upstream commit efad770 ]

The `seg` parameter is a pointer to pointer, we need to derefernce it to
check if we reached the end of SQ. Otherwise WQE data segment can be
written past SQ.

Fixes: f14d598 ("Implement memory window bind verb for type 1")
Signed-off-by: Alexey Marchuk <alexeymar@nvidia.com>
Reviewed-by: Sergey Gorenko <sergeygo@nvidia.com>
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Nicolas Morey-Chaisemartin <nmoreychaisemartin@suse.com>

providers/mlx5/qp.c

@@ -633,7 +633,7 @@ static inline int set_bind_wr(struct mlx5_qp *qp, enum ibv_mw_type type,
 	if (!bind_info->length)
 		return 0;
 
-	if (unlikely((seg == qend)))
+	if (unlikely((*seg == qend)))
 		*seg = mlx5_get_send_wqe(qp, 0);
 
 	set_umr_data_seg(qp, type, rkey, bind_info, qpn, seg, size);