Similar to the prior patch, these patterns are open coding an offsetofend() using sizeof(), which targets the last member of the current struct.
Signed-off-by: Jason Gunthorpe <[email protected]> --- drivers/infiniband/hw/mana/qp.c | 27 +++++++++------------------ drivers/infiniband/hw/mana/wq.c | 10 ++-------- drivers/infiniband/hw/mlx4/main.c | 6 ++---- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 13 ++----------- drivers/infiniband/sw/siw/siw_verbs.c | 6 +----- 6 files changed, 17 insertions(+), 47 deletions(-) diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c index 82f84f7ad37a90..69c8d4f7a1f46b 100644 --- a/drivers/infiniband/hw/mana/qp.c +++ b/drivers/infiniband/hw/mana/qp.c @@ -111,16 +111,12 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd, u32 port; int ret; - if (!udata || udata->inlen < sizeof(ucmd)) + if (!udata) return -EINVAL; - ret = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)); - if (ret) { - ibdev_dbg(&mdev->ib_dev, - "Failed copy from udata for create rss-qp, err %d\n", - ret); + ret = ib_copy_validate_udata_in(udata, ucmd, port); + if (ret) return ret; - } if (attr->cap.max_recv_wr > mdev->adapter_caps.max_qp_wr) { ibdev_dbg(&mdev->ib_dev, @@ -282,15 +278,12 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd, u32 port; int err; - if (!mana_ucontext || udata->inlen < sizeof(ucmd)) + if (!mana_ucontext) return -EINVAL; - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)); - if (err) { - ibdev_dbg(&mdev->ib_dev, - "Failed to copy from udata create qp-raw, %d\n", err); + err = ib_copy_validate_udata_in(udata, ucmd, port); + if (err) return err; - } if (attr->cap.max_send_wr > mdev->adapter_caps.max_qp_wr) { ibdev_dbg(&mdev->ib_dev, @@ -535,17 +528,15 @@ static int mana_ib_create_rc_qp(struct ib_qp *ibqp, struct ib_pd *ibpd, u64 flags = 0; u32 doorbell; - if (!udata || udata->inlen < sizeof(ucmd)) + if (!udata) return -EINVAL; mana_ucontext = rdma_udata_to_drv_context(udata, struct mana_ib_ucontext, ibucontext); doorbell = mana_ucontext->doorbell; flags = MANA_RC_FLAG_NO_FMR; - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)); - if (err) { - ibdev_dbg(&mdev->ib_dev, "Failed to copy from udata, %d\n", err); + err = ib_copy_validate_udata_in(udata, ucmd, queue_size); + if (err) return err; - } for (i = 0, j = 0; i < MANA_RC_QUEUE_TYPE_MAX; ++i) { /* skip FMR for user-level RC QPs */ diff --git a/drivers/infiniband/hw/mana/wq.c b/drivers/infiniband/hw/mana/wq.c index 6206244f762e42..aceeea7f17b339 100644 --- a/drivers/infiniband/hw/mana/wq.c +++ b/drivers/infiniband/hw/mana/wq.c @@ -15,15 +15,9 @@ struct ib_wq *mana_ib_create_wq(struct ib_pd *pd, struct mana_ib_wq *wq; int err; - if (udata->inlen < sizeof(ucmd)) - return ERR_PTR(-EINVAL); - - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)); - if (err) { - ibdev_dbg(&mdev->ib_dev, - "Failed to copy from udata for create wq, %d\n", err); + err = ib_copy_validate_udata_in(udata, ucmd, reserved); + if (err) return ERR_PTR(err); - } wq = kzalloc_obj(*wq); if (!wq) diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c index 73e17b4339eb60..16e4cffbd7a84d 100644 --- a/drivers/infiniband/hw/mlx4/main.c +++ b/drivers/infiniband/hw/mlx4/main.c @@ -50,6 +50,7 @@ #include <rdma/ib_user_verbs.h> #include <rdma/ib_addr.h> #include <rdma/ib_cache.h> +#include <rdma/uverbs_ioctl.h> #include <net/bonding.h> @@ -445,10 +446,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev, struct mlx4_clock_params clock_params; if (uhw->inlen) { - if (uhw->inlen < sizeof(cmd)) - return -EINVAL; - - err = ib_copy_from_udata(&cmd, uhw, sizeof(cmd)); + err = ib_copy_validate_udata_in(uhw, cmd, reserved); if (err) return err; diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c index 643b3b7d387834..f5e75e51c6763f 100644 --- a/drivers/infiniband/hw/mlx5/cq.c +++ b/drivers/infiniband/hw/mlx5/cq.c @@ -1229,7 +1229,7 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, struct ib_umem *umem; int err; - err = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd)); + err = ib_copy_validate_udata_in(udata, ucmd, reserved1); if (err) return err; diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index fe41362c51444c..c9fd40bfa09eb2 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -452,18 +452,9 @@ static int rxe_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr, int err; if (udata) { - if (udata->inlen < sizeof(cmd)) { - err = -EINVAL; - rxe_dbg_srq(srq, "malformed udata\n"); + err = ib_copy_validate_udata_in(udata, cmd, mmap_info_addr); + if (err) goto err_out; - } - - err = ib_copy_from_udata(&cmd, udata, sizeof(cmd)); - if (err) { - err = -EFAULT; - rxe_dbg_srq(srq, "unable to read udata\n"); - goto err_out; - } } err = rxe_srq_chk_attr(rxe, srq, attr, mask); diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c index ef504db8f2b48b..1e1d262a4ae2db 100644 --- a/drivers/infiniband/sw/siw/siw_verbs.c +++ b/drivers/infiniband/sw/siw/siw_verbs.c @@ -1373,11 +1373,7 @@ struct ib_mr *siw_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, struct siw_uresp_reg_mr uresp = {}; struct siw_mem *mem = mr->mem; - if (udata->inlen < sizeof(ureq)) { - rv = -EINVAL; - goto err_out; - } - rv = ib_copy_from_udata(&ureq, udata, sizeof(ureq)); + rv = ib_copy_validate_udata_in(udata, ureq, pad); if (rv) goto err_out; -- 2.43.0
