Like uverbs, check the length parameter before the command type.
Signed-off-by: Yann Droneaud <[email protected]>
Link: http://mid.gmane.org/[email protected]
---
drivers/infiniband/core/ucm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 8f8a0a8..49bf680 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1178,10 +1178,10 @@ static ssize_t ib_ucm_write(struct file *filp, const
char __user *buf,
if (copy_from_user(&hdr, buf, sizeof(hdr)))
return -EFAULT;
- if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
+ if (hdr.in + sizeof(hdr) > len)
return -EINVAL;
- if (hdr.in + sizeof(hdr) > len)
+ if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
return -EINVAL;
result = ucm_cmd_table[hdr.cmd](file, buf + sizeof(hdr),
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
