diff options
author | Mark Brown <broonie@kernel.org> | 2020-08-25 13:01:46 +0300 |
---|---|---|
committer | Mark Brown <broonie@kernel.org> | 2020-08-25 13:01:46 +0300 |
commit | 3bec5b6aae830355e786e204b20a7cea38c3a8ed (patch) | |
tree | fd597b87faf55ceb2a207ee94f4feca6276696db /drivers/infiniband/core/ucma.c | |
parent | a577f3456c0a2fac3dee037c483753e6e68f3e49 (diff) | |
parent | d012a7190fc1fd72ed48911e77ca97ba4521bccd (diff) | |
download | linux-3bec5b6aae830355e786e204b20a7cea38c3a8ed.tar.xz |
Merge tag 'v5.9-rc2' into regulator-5.9
Linux 5.9-rc2
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
-rw-r--r-- | drivers/infiniband/core/ucma.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 5b87eee8ccc8..d03dacaef788 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1084,6 +1084,8 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; @@ -1141,6 +1143,8 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; |