Follow the last member of each struct at the point MLX4_IB_UVERBS_ABI_VERSION was set to 4.
Signed-off-by: Jason Gunthorpe <[email protected]> --- drivers/infiniband/hw/mlx4/cq.c | 10 +++++----- drivers/infiniband/hw/mlx4/qp.c | 8 ++------ drivers/infiniband/hw/mlx4/srq.c | 5 +++-- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c index 8535fd561691d7..ed4c2e740670be 100644 --- a/drivers/infiniband/hw/mlx4/cq.c +++ b/drivers/infiniband/hw/mlx4/cq.c @@ -168,10 +168,9 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq, INIT_LIST_HEAD(&cq->send_qp_list); INIT_LIST_HEAD(&cq->recv_qp_list); - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { - err = -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); + if (err) goto err_cq; - } buf_addr = (void *)(unsigned long)ucmd.buf_addr; @@ -332,8 +331,9 @@ static int mlx4_alloc_resize_umem(struct mlx4_ib_dev *dev, struct mlx4_ib_cq *cq if (cq->resize_umem) return -EBUSY; - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, buf_addr); + if (err) + return err; cq->resize_buf = kmalloc_obj(*cq->resize_buf); if (!cq->resize_buf) diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index b87a4b7949a3a0..deb1b0306aa7a1 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -1053,16 +1053,12 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr, if (udata) { struct mlx4_ib_create_qp ucmd; - size_t copy_len; int shift; int n; - copy_len = sizeof(struct mlx4_ib_create_qp); - - if (ib_copy_from_udata(&ucmd, udata, copy_len)) { - err = -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, sq_no_prefetch); + if (err) goto err; - } qp->inl_recv_sz = ucmd.inl_recv_sz; diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c index c4cf91235eee3a..5b23e5f8b84aca 100644 --- a/drivers/infiniband/hw/mlx4/srq.c +++ b/drivers/infiniband/hw/mlx4/srq.c @@ -111,8 +111,9 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq, if (udata) { struct mlx4_ib_create_srq ucmd; - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, db_addr); + if (err) + return err; srq->umem = ib_umem_get(ib_srq->device, ucmd.buf_addr, buf_size, 0); -- 2.43.0
