diff options
| author | Michael J. Ruhl <michael.j.ruhl@intel.com> | 2017-04-09 20:16:03 +0300 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2017-04-28 20:48:01 +0300 |
| commit | db730894f4f7e7afcaf31d17679ed58b4f781500 (patch) | |
| tree | 32e6004b5a0265a0f19668370f160016959721c4 /drivers/infiniband | |
| parent | aad9ff97ddd774f03f5e055ade2b2d27a9c82ddb (diff) | |
| download | linux-db730894f4f7e7afcaf31d17679ed58b4f781500.tar.xz | |
IB/hfi1: Validate the TID count before using it
Improve the safety of the code by validating the user supplied
tidcnt before use.
Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/user_exp_rcv.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c index 002214eef472..35c6e7ec8ad6 100644 --- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c +++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c @@ -579,6 +579,9 @@ int hfi1_user_exp_rcv_clear(struct file *fp, struct hfi1_tid_info *tinfo) u32 *tidinfo; unsigned tididx; + if (unlikely(tinfo->tidcnt > fd->tid_used)) + return -EINVAL; + tidinfo = memdup_user((void __user *)(unsigned long)tinfo->tidlist, sizeof(tidinfo[0]) * tinfo->tidcnt); if (IS_ERR(tidinfo)) |