diff options
| author | Dave Airlie <airlied@redhat.com> | 2020-08-11 11:58:31 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2020-08-11 11:58:31 +1000 |
| commit | c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5 (patch) | |
| tree | ad77b18ffeafb50b3eb9ba6472670dc1d96f5558 /drivers/infiniband/core/ucma.c | |
| parent | ca457ab5908603b36be903e73977afde1ba03c84 (diff) | |
| parent | bcf876870b95592b52519ed4aafcf9d95999bc9c (diff) | |
| download | linux-c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5.tar.bz2 | |
Merge tag 'v5.8' into drm-next
I need to backmerge 5.8 as I've got a bunch of fixes sitting
on an rc7 base that I want to land.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
| -rw-r--r-- | drivers/infiniband/core/ucma.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 5b87eee8ccc8..d03dacaef788 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1084,6 +1084,8 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; @@ -1141,6 +1143,8 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf, size_t in_size; int ret; + if (in_len < offsetofend(typeof(cmd), reserved)) + return -EINVAL; in_size = min_t(size_t, in_len, sizeof(cmd)); if (copy_from_user(&cmd, inbuf, in_size)) return -EFAULT; |