irdma has a comp_mask field that was never checked for validity, check
it.

Signed-off-by: Jason Gunthorpe <[email protected]>
---
 drivers/infiniband/hw/irdma/verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/verbs.c 
b/drivers/infiniband/hw/irdma/verbs.c
index b2978632241900..d695130b187bdd 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -296,7 +296,9 @@ static int irdma_alloc_ucontext(struct ib_ucontext *uctx,
        if (udata->outlen < IRDMA_ALLOC_UCTX_MIN_RESP_LEN)
                return -EINVAL;
 
-       ret = ib_copy_validate_udata_in(udata, req, rsvd8);
+       ret = ib_copy_validate_udata_in_cm(udata, req, rsvd8,
+                                          IRDMA_ALLOC_UCTX_USE_RAW_ATTR |
+                                                  IRDMA_SUPPORT_WQE_FORMAT_V2);
        if (ret)
                return ret;
 
-- 
2.43.0


Reply via email to