Since comp_mask field is designed to describe extensions to each command, the size of the command buffer can be checked against the theoretical command size for the given comp_mask.
So having unknown fields in the command buffer, not announced in the "comp_mask" is an error. Cc: Igor Ivanov <[email protected]> Cc: Matan Barak <[email protected]> Signed-off-by: Yann Droneaud <[email protected]> Link: http://marc.info/[email protected] Link: http://mid.gmane.org/[email protected] --- drivers/infiniband/core/uverbs_cmd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index df5b443..3b09f1d 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -2652,6 +2652,9 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file, if (comp_mask) return -EINVAL; + if (ucore->inlen != sizeof(cmd)) + return -EINVAL; + if (ucore->outlen < sizeof(resp)) return -ENOSPC; @@ -2801,6 +2804,9 @@ int ib_uverbs_ex_destroy_flow(struct ib_uverbs_file *file, if (comp_mask) return -EINVAL; + if (ucore->inlen != sizeof(cmd)) + return -EINVAL; + ret = ib_copy_from_udata(&cmd, ucore, sizeof(cmd)); if (ret) return ret; -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
