summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core/ucma.c
diff options
context:
space:
mode:
authorMark Brown <broonie@kernel.org>2020-08-25 13:01:46 +0300
committerMark Brown <broonie@kernel.org>2020-08-25 13:01:46 +0300
commit3bec5b6aae830355e786e204b20a7cea38c3a8ed (patch)
treefd597b87faf55ceb2a207ee94f4feca6276696db /drivers/infiniband/core/ucma.c
parenta577f3456c0a2fac3dee037c483753e6e68f3e49 (diff)
parentd012a7190fc1fd72ed48911e77ca97ba4521bccd (diff)
downloadlinux-3bec5b6aae830355e786e204b20a7cea38c3a8ed.tar.xz
Merge tag 'v5.9-rc2' into regulator-5.9
Linux 5.9-rc2
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
-rw-r--r--drivers/infiniband/core/ucma.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 5b87eee8ccc8..d03dacaef788 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1084,6 +1084,8 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
size_t in_size;
int ret;
+ if (in_len < offsetofend(typeof(cmd), reserved))
+ return -EINVAL;
in_size = min_t(size_t, in_len, sizeof(cmd));
if (copy_from_user(&cmd, inbuf, in_size))
return -EFAULT;
@@ -1141,6 +1143,8 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
size_t in_size;
int ret;
+ if (in_len < offsetofend(typeof(cmd), reserved))
+ return -EINVAL;
in_size = min_t(size_t, in_len, sizeof(cmd));
if (copy_from_user(&cmd, inbuf, in_size))
return -EFAULT;