tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

RDMA/mlx4: Use ib_copy_validate_udata_in()

Follow the last member of each struct at the point
MLX4_IB_UVERBS_ABI_VERSION was set to 4.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

authored by

Jason Gunthorpe and committed by
Leon Romanovsky f8997870 530b251b

+10 -13
+5 -5
drivers/infiniband/hw/mlx4/cq.c
··· 168 168 INIT_LIST_HEAD(&cq->send_qp_list); 169 169 INIT_LIST_HEAD(&cq->recv_qp_list); 170 170 171 - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { 172 - err = -EFAULT; 171 + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); 172 + if (err) 173 173 goto err_cq; 174 - } 175 174 176 175 if (ibcq->umem && 177 176 (dev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_SW_CQ_INIT)) ··· 335 336 if (cq->resize_umem) 336 337 return -EBUSY; 337 338 338 - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) 339 - return -EFAULT; 339 + err = ib_copy_validate_udata_in(udata, ucmd, buf_addr); 340 + if (err) 341 + return err; 340 342 341 343 cq->resize_buf = kmalloc_obj(*cq->resize_buf); 342 344 if (!cq->resize_buf)
+2 -6
drivers/infiniband/hw/mlx4/qp.c
··· 1053 1053 1054 1054 if (udata) { 1055 1055 struct mlx4_ib_create_qp ucmd; 1056 - size_t copy_len; 1057 1056 int shift; 1058 1057 int n; 1059 1058 1060 - copy_len = sizeof(struct mlx4_ib_create_qp); 1061 - 1062 - if (ib_copy_from_udata(&ucmd, udata, copy_len)) { 1063 - err = -EFAULT; 1059 + err = ib_copy_validate_udata_in(udata, ucmd, sq_no_prefetch); 1060 + if (err) 1064 1061 goto err; 1065 - } 1066 1062 1067 1063 qp->inl_recv_sz = ucmd.inl_recv_sz; 1068 1064
+3 -2
drivers/infiniband/hw/mlx4/srq.c
··· 111 111 if (udata) { 112 112 struct mlx4_ib_create_srq ucmd; 113 113 114 - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) 115 - return -EFAULT; 114 + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); 115 + if (err) 116 + return err; 116 117 117 118 srq->umem = 118 119 ib_umem_get(ib_srq->device, ucmd.buf_addr, buf_size, 0);