diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-20 11:27:18 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-20 11:27:18 +0100 |
| commit | 4958134df54c2c84e9c22ea042761d439164d26e (patch) | |
| tree | 503177afab11f7d25b12a84ce25b481d305c51ba /drivers/infiniband/core/ucma.c | |
| parent | c4f528795d1add8b63652673f7262729f679c6c1 (diff) | |
| parent | c698ca5278934c0ae32297a8725ced2e27585d7f (diff) | |
Merge 4.16-rc6 into tty-next
We want the serial/tty fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
| -rw-r--r-- | drivers/infiniband/core/ucma.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index f015f1bf88c9..3a9d0f5b5881 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1149,6 +1149,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, if (copy_from_user(&cmd, inbuf, sizeof(cmd))) return -EFAULT; + if (cmd.qp_state > IB_QPS_ERR) + return -EINVAL; + ctx = ucma_get_ctx(file, cmd.id); if (IS_ERR(ctx)) return PTR_ERR(ctx); @@ -1294,6 +1297,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, if (IS_ERR(ctx)) return PTR_ERR(ctx); + if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) + return -EINVAL; + optval = memdup_user((void __user *) (unsigned long) cmd.optval, cmd.optlen); if (IS_ERR(optval)) { |