flags is the last member for mlx5_ib_create_srq, the uidx is a later extension.
Signed-off-by: Jason Gunthorpe <[email protected]> --- drivers/infiniband/hw/mlx5/srq.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c index 17e018554d81d5..6d89c0242cab61 100644 --- a/drivers/infiniband/hw/mlx5/srq.c +++ b/drivers/infiniband/hw/mlx5/srq.c @@ -48,25 +48,16 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq, struct mlx5_ib_create_srq ucmd = {}; struct mlx5_ib_ucontext *ucontext = rdma_udata_to_drv_context( udata, struct mlx5_ib_ucontext, ibucontext); - size_t ucmdlen; int err; u32 uidx = MLX5_IB_DEFAULT_UIDX; - ucmdlen = min(udata->inlen, sizeof(ucmd)); - - if (ib_copy_from_udata(&ucmd, udata, ucmdlen)) { - mlx5_ib_dbg(dev, "failed copy udata\n"); - return -EFAULT; - } + err = ib_copy_validate_udata_in(udata, ucmd, flags); + if (err) + return err; if (ucmd.reserved0 || ucmd.reserved1) return -EINVAL; - if (udata->inlen > sizeof(ucmd) && - !ib_is_udata_cleared(udata, sizeof(ucmd), - udata->inlen - sizeof(ucmd))) - return -EINVAL; - if (in->type != IB_SRQT_BASIC) { err = get_srq_user_index(ucontext, &ucmd, udata->inlen, &uidx); if (err) -- 2.43.0
