diff options
| author | Dave Airlie <[email protected]> | 2020-08-11 01:58:31 +0000 |
|---|---|---|
| committer | Dave Airlie <[email protected]> | 2020-08-11 01:58:31 +0000 |
| commit | c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5 (patch) | |
| tree | ad77b18ffeafb50b3eb9ba6472670dc1d96f5558 /drivers/infiniband/core/ucma.c | |
| parent | Merge tag 'drm-misc-next-fixes-2020-08-05' of git://anongit.freedesktop.org/d... (diff) | |
| parent | Linux 5.8 (diff) | |
| download | kernel-c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5.tar.gz kernel-c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5.zip | |
Merge tag 'v5.8' into drm-next
I need to backmerge 5.8 as I've got a bunch of fixes sitting
on an rc7 base that I want to land.
Signed-off-by: Dave Airlie <[email protected]>
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
| -rw-r--r-- | drivers/infiniband/core/ucma.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 5b87eee8ccc8..d03dacaef788 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1084,6 +1084,8 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; @@ -1141,6 +1143,8 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; |