From: Leon Romanovsky <leonro@mellanox.com>
Date: Wed, 21 Feb 2018 18:12:34 +0200
Subject: RDMA/uverbs: Fail as early as possible if not enough header data was
provided
Patch-mainline: v4.17-rc1
Git-commit: 43ae95130db8fb70010f09b734c7c606eb9e61ce
References: bsc#1103992 FATE#326009
Fail as early as possible if not enough header data
was provided.
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
drivers/infiniband/core/uverbs_main.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -662,6 +662,7 @@ static ssize_t ib_uverbs_write(struct fi
size_t count, loff_t *pos)
{
struct ib_uverbs_file *file = filp->private_data;
+ struct ib_uverbs_ex_cmd_hdr ex_hdr;
struct ib_device *ib_dev;
struct ib_uverbs_cmd_hdr hdr;
bool extended_command;
@@ -706,6 +707,12 @@ static ssize_t ib_uverbs_write(struct fi
goto out;
}
+ if (extended_command &&
+ count < (sizeof(hdr) + sizeof(ex_hdr))) {
+ ret = -EINVAL;
+ goto out;
+ }
+
if (!verify_command_idx(command, extended_command)) {
ret = -EINVAL;
goto out;
@@ -738,7 +745,6 @@ static ssize_t ib_uverbs_write(struct fi
hdr.in_words * 4,
hdr.out_words * 4);
} else {
- struct ib_uverbs_ex_cmd_hdr ex_hdr;
struct ib_udata ucore;
struct ib_udata uhw;
size_t written_count = count;
@@ -752,11 +758,6 @@ static ssize_t ib_uverbs_write(struct fi
ret = -EINVAL;
goto out;
}
-
- if (count < (sizeof(hdr) + sizeof(ex_hdr))) {
- ret = -EINVAL;
- goto out;
- }
if (copy_from_user(&ex_hdr, buf + sizeof(hdr), sizeof(ex_hdr))) {
ret = -EFAULT;