Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db730894 authored by Michael J. Ruhl's avatar Michael J. Ruhl Committed by Doug Ledford
Browse files

IB/hfi1: Validate the TID count before using it 



Improve the safety of the code by validating the user supplied
tidcnt before use.

Reviewed-by: default avatarMitko Haralanov <mitko.haralanov@intel.com>
Reviewed-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent aad9ff97

drivers/infiniband/hw/hfi1/user_exp_rcv.c

+3 −0
Original line number Diff line number Diff line
@@ -579,6 +579,9 @@ int hfi1_user_exp_rcv_clear(struct file *fp, struct hfi1_tid_info *tinfo) 
	u32 *tidinfo;

	unsigned tididx;



	if (unlikely(tinfo->tidcnt > fd->tid_used))

		return -EINVAL;



	tidinfo = memdup_user((void __user *)(unsigned long)tinfo->tidlist,

			      sizeof(tidinfo[0]) * tinfo->tidcnt);

	if (IS_ERR(tidinfo))