diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2026-03-26 00:26:54 +0300 |
|---|---|---|
| committer | Leon Romanovsky <leonro@nvidia.com> | 2026-03-31 10:18:16 +0300 |
| commit | f899787095cdb537cf1b5710b1e7b243da655e8b (patch) | |
| tree | 9d4ec58bae1add65774d557c6e236150ea8e9c6b | |
| parent | 530b251b0f7a44d10bc493d970fa3663962ba16f (diff) | |
| download | linux-f899787095cdb537cf1b5710b1e7b243da655e8b.tar.xz | |
RDMA/mlx4: Use ib_copy_validate_udata_in()
Follow the last member of each struct at the point
MLX4_IB_UVERBS_ABI_VERSION was set to 4.
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
| -rw-r--r-- | drivers/infiniband/hw/mlx4/cq.c | 10 | ||||
| -rw-r--r-- | drivers/infiniband/hw/mlx4/qp.c | 8 | ||||
| -rw-r--r-- | drivers/infiniband/hw/mlx4/srq.c | 5 |
3 files changed, 10 insertions, 13 deletions
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c index 6fef3f1724eb..7a6eb602d4a6 100644 --- a/drivers/infiniband/hw/mlx4/cq.c +++ b/drivers/infiniband/hw/mlx4/cq.c @@ -168,10 +168,9 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq, INIT_LIST_HEAD(&cq->send_qp_list); INIT_LIST_HEAD(&cq->recv_qp_list); - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { - err = -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); + if (err) goto err_cq; - } if (ibcq->umem && (dev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_SW_CQ_INIT)) @@ -336,8 +335,9 @@ static int mlx4_alloc_resize_umem(struct mlx4_ib_dev *dev, struct mlx4_ib_cq *cq if (cq->resize_umem) return -EBUSY; - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, buf_addr); + if (err) + return err; cq->resize_buf = kmalloc_obj(*cq->resize_buf); if (!cq->resize_buf) diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index b87a4b7949a3..deb1b0306aa7 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -1053,16 +1053,12 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr, if (udata) { struct mlx4_ib_create_qp ucmd; - size_t copy_len; int shift; int n; - copy_len = sizeof(struct mlx4_ib_create_qp); - - if (ib_copy_from_udata(&ucmd, udata, copy_len)) { - err = -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, sq_no_prefetch); + if (err) goto err; - } qp->inl_recv_sz = ucmd.inl_recv_sz; diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c index c4cf91235eee..5b23e5f8b84a 100644 --- a/drivers/infiniband/hw/mlx4/srq.c +++ b/drivers/infiniband/hw/mlx4/srq.c @@ -111,8 +111,9 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq, if (udata) { struct mlx4_ib_create_srq ucmd; - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); + if (err) + return err; srq->umem = ib_umem_get(ib_srq->device, ucmd.buf_addr, buf_size, 0); |