| Message ID | 1583845569-47257-1-git-send-email-liweihang@huawei.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 9e57a9aa694cfc28f9549d2ce587309fdac15bfb |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [for-next] RDMA/hns: Fix wrong judgments of udata->outlen | expand |
On Tue, Mar 10, 2020 at 09:06:09PM +0800, Weihang Li wrote: > These judgments were used to keep the compatibility with older versions of > userspace that don't have the field named "cap_flags" in structure > hns_roce_ib_create_cq_resp. But it will be wrong to compare outlen with > the size of resp if another new field were added in resp. oulen should be > compared with the end offset of cap_flags in resp. > > Fixes: 4f8f0d5e33dd ("RDMA/hns: Package the flow of creating cq") > Signed-off-by: Weihang Li <liweihang@huawei.com> > --- > Related discussions can be found at: > https://patchwork.kernel.org/patch/11372851/ > drivers/infiniband/hw/hns/hns_roce_cq.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) Applied to for-next, thanks Jason
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c index 5ffe4c9..5bfb52f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cq.c +++ b/drivers/infiniband/hw/hns/hns_roce_cq.c @@ -257,8 +257,8 @@ static int create_user_cq(struct hns_roce_dev *hr_dev, return ret; } - if ((hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RECORD_DB) && - (udata->outlen >= sizeof(*resp))) { + if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RECORD_DB && + udata->outlen >= offsetofend(typeof(*resp), cap_flags)) { ret = hns_roce_db_map_user(context, udata, ucmd.db_addr, &hr_cq->db); if (ret) { @@ -321,8 +321,8 @@ static void destroy_user_cq(struct hns_roce_dev *hr_dev, struct hns_roce_ucontext *context = rdma_udata_to_drv_context( udata, struct hns_roce_ucontext, ibucontext); - if ((hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RECORD_DB) && - (udata->outlen >= sizeof(*resp))) + if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RECORD_DB && + udata->outlen >= offsetofend(typeof(*resp), cap_flags)) hns_roce_db_unmap_user(context, &hr_cq->db); hns_roce_mtt_cleanup(hr_dev, &hr_cq->mtt);
These judgments were used to keep the compatibility with older versions of userspace that don't have the field named "cap_flags" in structure hns_roce_ib_create_cq_resp. But it will be wrong to compare outlen with the size of resp if another new field were added in resp. oulen should be compared with the end offset of cap_flags in resp. Fixes: 4f8f0d5e33dd ("RDMA/hns: Package the flow of creating cq") Signed-off-by: Weihang Li <liweihang@huawei.com> --- Related discussions can be found at: https://patchwork.kernel.org/patch/11372851/ drivers/infiniband/hw/hns/hns_roce_cq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)