Like uverbs, check the length parameter before the command type.
Signed-off-by: Yann Droneaud <[email protected]>
Link: http://mid.gmane.org/[email protected]
---
drivers/infiniband/core/ucma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ecc6fad..92f2248 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1573,10 +1573,10 @@ static ssize_t ucma_write(struct file *filp, const char
__user *buf,
if (copy_from_user(&hdr, buf, sizeof(hdr)))
return -EFAULT;
- if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table))
+ if (hdr.in + sizeof(hdr) > len)
return -EINVAL;
- if (hdr.in + sizeof(hdr) > len)
+ if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table))
return -EINVAL;
if (!ucma_cmd_table[hdr.cmd])
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
