All of these cases have git blames that say the entire current struct was introduced at once, so the last member is the right choice.
Signed-off-by: Jason Gunthorpe <[email protected]> --- drivers/infiniband/hw/erdma/erdma_verbs.c | 6 ++-- .../infiniband/hw/ionic/ionic_controlpath.c | 6 ++-- drivers/infiniband/hw/mthca/mthca_provider.c | 27 +++++++++------ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 10 +++--- drivers/infiniband/hw/qedr/verbs.c | 34 ++++++------------- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 6 ++-- drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c | 6 ++-- 8 files changed, 45 insertions(+), 52 deletions(-) diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c index 04136a0281aa4c..5523b4e151e1ff 100644 --- a/drivers/infiniband/hw/erdma/erdma_verbs.c +++ b/drivers/infiniband/hw/erdma/erdma_verbs.c @@ -1039,8 +1039,7 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, qp->attrs.rq_size = roundup_pow_of_two(attrs->cap.max_recv_wr); if (uctx) { - ret = ib_copy_from_udata(&ureq, udata, - min(sizeof(ureq), udata->inlen)); + ret = ib_copy_validate_udata_in(udata, ureq, rsvd0); if (ret) goto err_out_xa; @@ -1980,8 +1979,7 @@ int erdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, struct erdma_ureq_create_cq ureq; struct erdma_uresp_create_cq uresp; - ret = ib_copy_from_udata(&ureq, udata, - min(udata->inlen, sizeof(ureq))); + ret = ib_copy_validate_udata_in(udata, ureq, rsvd0); if (ret) goto err_out_xa; diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c index 4842931f5316ee..cbdb0ea7782a49 100644 --- a/drivers/infiniband/hw/ionic/ionic_controlpath.c +++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c @@ -373,7 +373,7 @@ int ionic_alloc_ucontext(struct ib_ucontext *ibctx, struct ib_udata *udata) phys_addr_t db_phys = 0; int rc; - rc = ib_copy_from_udata(&req, udata, sizeof(req)); + rc = ib_copy_validate_udata_in(udata, req, rsvd); if (rc) return rc; @@ -1223,7 +1223,7 @@ int ionic_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, int udma_idx = 0, rc; if (udata) { - rc = ib_copy_from_udata(&req, udata, sizeof(req)); + rc = ib_copy_validate_udata_in(udata, req, rsvd); if (rc) return rc; } @@ -2152,7 +2152,7 @@ int ionic_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attr, int rc; if (udata) { - rc = ib_copy_from_udata(&req, udata, sizeof(req)); + rc = ib_copy_validate_udata_in(udata, req, rsvd); if (rc) return rc; } else { diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c index 6a0795332616dc..7467e3dff7ebb8 100644 --- a/drivers/infiniband/hw/mthca/mthca_provider.c +++ b/drivers/infiniband/hw/mthca/mthca_provider.c @@ -402,8 +402,9 @@ static int mthca_create_srq(struct ib_srq *ibsrq, return -EOPNOTSUPP; if (udata) { - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, db_page); + if (err) + return err; err = mthca_map_user_db(to_mdev(ibsrq->device), &context->uar, context->db_tab, ucmd.db_index, @@ -472,8 +473,9 @@ static int mthca_create_qp(struct ib_qp *ibqp, case IB_QPT_UD: { if (udata) { - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, rq_db_index); + if (err) + return err; err = mthca_map_user_db(dev, &context->uar, context->db_tab, @@ -594,8 +596,9 @@ static int mthca_create_cq(struct ib_cq *ibcq, return -EINVAL; if (udata) { - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) - return -EFAULT; + err = ib_copy_validate_udata_in(udata, ucmd, set_db_index); + if (err) + return err; err = mthca_map_user_db(to_mdev(ibdev), &context->uar, context->db_tab, ucmd.set_db_index, @@ -720,10 +723,9 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda goto out; lkey = cq->resize_buf->buf.mr.ibmr.lkey; } else { - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) { - ret = -EFAULT; + ret = ib_copy_validate_udata_in(udata, ucmd, reserved); + if (ret) goto out; - } lkey = ucmd.lkey; } @@ -851,8 +853,11 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, } ++context->reg_mr_warned; ucmd.mr_attrs = 0; - } else if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) - return ERR_PTR(-EFAULT); + } else { + err = ib_copy_validate_udata_in(udata, ucmd, reserved); + if (err) + return ERR_PTR(err); + } mr = kmalloc_obj(*mr); if (!mr) diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c index 7383b67e172312..8b285fcc638701 100644 --- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c @@ -983,8 +983,9 @@ int ocrdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, return -EOPNOTSUPP; if (udata) { - if (ib_copy_from_udata(&ureq, udata, sizeof(ureq))) - return -EFAULT; + status = ib_copy_validate_udata_in(udata, ureq, rsvd); + if (status) + return status; } else ureq.dpp_cq = 0; @@ -1312,8 +1313,9 @@ int ocrdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, memset(&ureq, 0, sizeof(ureq)); if (udata) { - if (ib_copy_from_udata(&ureq, udata, sizeof(ureq))) - return -EFAULT; + status = ib_copy_validate_udata_in(udata, ureq, rsvd1); + if (status) + return status; } ocrdma_set_qp_init_params(qp, pd, attrs); if (udata == NULL) diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index 2fa9e07710d31f..42d20b35ff3fe0 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -273,12 +273,9 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata) return -EFAULT; if (udata->inlen) { - rc = ib_copy_from_udata(&ureq, udata, - min(sizeof(ureq), udata->inlen)); - if (rc) { - DP_ERR(dev, "Problem copying data from user space\n"); - return -EFAULT; - } + rc = ib_copy_validate_udata_in(udata, ureq, reserved); + if (rc) + return rc; ctx->edpm_mode = !!(ureq.context_flags & QEDR_ALLOC_UCTX_EDPM_MODE); ctx->db_rec = !!(ureq.context_flags & QEDR_ALLOC_UCTX_DB_REC); @@ -949,12 +946,9 @@ int qedr_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, db_offset = DB_ADDR_SHIFT(DQ_PWM_OFFSET_UCM_RDMA_CQ_CONS_32BIT); if (udata) { - if (ib_copy_from_udata(&ureq, udata, min(sizeof(ureq), - udata->inlen))) { - DP_ERR(dev, - "create cq: problem copying data from user space\n"); - goto err0; - } + rc = ib_copy_validate_udata_in(udata, ureq, len); + if (rc) + return rc; if (!ureq.len) { DP_ERR(dev, @@ -1575,12 +1569,9 @@ int qedr_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init_attr, hw_srq->max_sges = init_attr->attr.max_sge; if (udata) { - if (ib_copy_from_udata(&ureq, udata, min(sizeof(ureq), - udata->inlen))) { - DP_ERR(dev, - "create srq: problem copying data from user space\n"); - goto err0; - } + rc = ib_copy_validate_udata_in(udata, ureq, srq_len); + if (rc) + return rc; rc = qedr_init_srq_user_params(udata, srq, &ureq, 0); if (rc) @@ -1860,12 +1851,9 @@ static int qedr_create_user_qp(struct qedr_dev *dev, } if (udata) { - rc = ib_copy_from_udata(&ureq, udata, min(sizeof(ureq), - udata->inlen)); - if (rc) { - DP_ERR(dev, "Problem copying data from user space\n"); + rc = ib_copy_validate_udata_in(udata, ureq, rq_len); + if (rc) return rc; - } } if (qedr_qp_has_sq(qp)) { diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c index 16b269128f52d3..615de9c4209bf1 100644 --- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c +++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c @@ -476,7 +476,7 @@ int usnic_ib_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr, if (init_attr->create_flags) return -EOPNOTSUPP; - err = ib_copy_from_udata(&cmd, udata, sizeof(cmd)); + err = ib_copy_validate_udata_in(udata, cmd, spec); if (err) { usnic_err("%s: cannot copy udata for create_qp\n", dev_name(&us_ibdev->ib_dev.dev)); diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c index 98b2a0090bf2a1..16aab967a20308 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c @@ -49,6 +49,7 @@ #include <rdma/ib_addr.h> #include <rdma/ib_smi.h> #include <rdma/ib_user_verbs.h> +#include <rdma/uverbs_ioctl.h> #include "pvrdma.h" @@ -252,10 +253,9 @@ int pvrdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr, dev_dbg(&dev->pdev->dev, "create queuepair from user space\n"); - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { - ret = -EFAULT; + ret = ib_copy_validate_udata_in(udata, ucmd, qp_addr); + if (ret) goto err_qp; - } /* Userspace supports qpn and qp handles? */ if (dev->dsr_version >= PVRDMA_QPHANDLE_VERSION && diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c index bdc2703532c6cc..d31fb692fcaafb 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c @@ -49,6 +49,7 @@ #include <rdma/ib_addr.h> #include <rdma/ib_smi.h> #include <rdma/ib_user_verbs.h> +#include <rdma/uverbs_ioctl.h> #include "pvrdma.h" @@ -141,10 +142,9 @@ int pvrdma_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init_attr, dev_dbg(&dev->pdev->dev, "create shared receive queue from user space\n"); - if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { - ret = -EFAULT; + ret = ib_copy_validate_udata_in(udata, ucmd, reserved); + if (ret) goto err_srq; - } srq->umem = ib_umem_get(ibsrq->device, ucmd.buf_addr, ucmd.buf_size, 0); if (IS_ERR(srq->umem)) { -- 2.43.0
