diff options
| author | Wolfram Sang <wsa@the-dreams.de> | 2018-03-24 13:39:18 +0100 |
|---|---|---|
| committer | Wolfram Sang <wsa@the-dreams.de> | 2018-03-24 13:39:18 +0100 |
| commit | 0b884c22c5b7f6ef985b3d39fed06ad1f8296042 (patch) | |
| tree | 74504e80ad62cb0acabdfa796348d001d5d1a2a4 /drivers/infiniband/core/ucma.c | |
| parent | eb49778c8c6cbe075cf90d741ccf16f674a8db4e (diff) | |
| parent | 84e10623c0b9c81557918804f309d66aec86a233 (diff) | |
| download | linux-0b884c22c5b7f6ef985b3d39fed06ad1f8296042.tar.gz linux-0b884c22c5b7f6ef985b3d39fed06ad1f8296042.tar.xz | |
Merge tag 'at24-4.17-updates-for-wolfram' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-4.17
"three new special cases for device tree compatible strings"
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
| -rw-r--r-- | drivers/infiniband/core/ucma.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index f015f1bf88c9..3a9d0f5b5881 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1149,6 +1149,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, if (copy_from_user(&cmd, inbuf, sizeof(cmd))) return -EFAULT; + if (cmd.qp_state > IB_QPS_ERR) + return -EINVAL; + ctx = ucma_get_ctx(file, cmd.id); if (IS_ERR(ctx)) return PTR_ERR(ctx); @@ -1294,6 +1297,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, if (IS_ERR(ctx)) return PTR_ERR(ctx); + if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) + return -EINVAL; + optval = memdup_user((void __user *) (unsigned long) cmd.optval, cmd.optlen); if (IS_ERR(optval)) { |