Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43ae9513 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Doug Ledford
Browse files

RDMA/uverbs: Fail as early as possible if not enough header data was provided 



Fail as early as possible if not enough header data
was provided.

Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent a6c4a66a

drivers/infiniband/core/uverbs_main.c

+7 −6
Original line number Diff line number Diff line
@@ -662,6 +662,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, 
			     size_t count, loff_t *pos)

{

	struct ib_uverbs_file *file = filp->private_data;

	struct ib_uverbs_ex_cmd_hdr ex_hdr;

	struct ib_device *ib_dev;

	struct ib_uverbs_cmd_hdr hdr;

	bool extended_command;
@@ -706,6 +707,12 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, 
		goto out;

	}



	if (extended_command &&

	    count < (sizeof(hdr) + sizeof(ex_hdr))) {

		ret = -EINVAL;

		goto out;

	}



	if (!verify_command_idx(command, extended_command)) {

		ret = -EINVAL;

		goto out;
@@ -738,7 +745,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, 
						 hdr.in_words * 4,

						 hdr.out_words * 4);

	} else {

		struct ib_uverbs_ex_cmd_hdr ex_hdr;

		struct ib_udata ucore;

		struct ib_udata uhw;

		size_t written_count = count;
@@ -753,11 +759,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, 
			goto out;

		}



		if (count < (sizeof(hdr) + sizeof(ex_hdr))) {

			ret = -EINVAL;

			goto out;

		}



		if (copy_from_user(&ex_hdr, buf + sizeof(hdr), sizeof(ex_hdr))) {

			ret = -EFAULT;

			goto out;