diff options
authorRoland Dreier <>2005-11-18 14:18:26 -0800
committerRoland Dreier <>2005-11-18 14:18:26 -0800
commiteabc77935d8d2a761c88b9cbb6313bd54b6ddbb3 (patch)
parent48fd0d1fdd357caa2de8cb4ce6af810df7535f43 (diff)
IB/umad: make sure write()s have sufficient data
Make sure that userspace passes in enough data when sending a MAD. We always copy at least sizeof (struct ib_user_mad) + IB_MGMT_RMPP_HDR bytes from userspace, so anything less is definitely invalid. Also, if the length is less than this limit, it's possible for the second copy_from_user() to get a negative length and trigger a BUG(). Signed-off-by: Roland Dreier <>
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 5ea741f47fc8..e73f81c22381 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -312,7 +312,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
int ret, length, hdr_len, copy_offset;
int rmpp_active = 0;
- if (count < sizeof (struct ib_user_mad))
+ if (count < sizeof (struct ib_user_mad) + IB_MGMT_RMPP_HDR)
return -EINVAL;
length = count - sizeof (struct ib_user_mad);