diff options
| author |   Leon Romanovsky <leonro@mellanox.com> | 2018-02-21 18:12:34 +0200 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2018-02-22 22:29:11 -0500 |
| commit | 43ae95130db8fb70010f09b734c7c606eb9e61ce (patch) | |
| tree | 5238717f4ddfb0d292bff596ff7650bf2de2cb9a /drivers/infiniband | |
| parent | RDMA/uverbs: Refactor flags checks and update return value (diff) | |
| download | linux-dev-43ae95130db8fb70010f09b734c7c606eb9e61ce.tar.xz linux-dev-43ae95130db8fb70010f09b734c7c606eb9e61ce.zip | |
RDMA/uverbs: Fail as early as possible if not enough header data was provided
Fail as early as possible if not enough header data
was provided.
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/infiniband/core/uverbs_main.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c index d28b6f1543c7..2189a26bbe64 100644 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c @@ -662,6 +662,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, size_t count, loff_t *pos) { struct ib_uverbs_file *file = filp->private_data; + struct ib_uverbs_ex_cmd_hdr ex_hdr; struct ib_device *ib_dev; struct ib_uverbs_cmd_hdr hdr; bool extended_command; @@ -706,6 +707,12 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, goto out; } + if (extended_command && + count < (sizeof(hdr) + sizeof(ex_hdr))) { + ret = -EINVAL; + goto out; + } + if (!verify_command_idx(command, extended_command)) { ret = -EINVAL; goto out; @@ -738,7 +745,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, hdr.in_words * 4, hdr.out_words * 4); } else { - struct ib_uverbs_ex_cmd_hdr ex_hdr; struct ib_udata ucore; struct ib_udata uhw; size_t written_count = count; @@ -753,11 +759,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, goto out; } - if (count < (sizeof(hdr) + sizeof(ex_hdr))) { - ret = -EINVAL; - goto out; - } - if (copy_from_user(&ex_hdr, buf + sizeof(hdr), sizeof(ex_hdr))) { ret = -EFAULT; goto out; |