IB/uverbs: Check input length in flow steering uverbs
authorYann Droneaud <ydroneaud@opteya.com>
Wed, 11 Dec 2013 22:01:52 +0000 (23:01 +0100)
committerRoland Dreier <roland@purestorage.com>
Fri, 20 Dec 2013 18:54:33 +0000 (10:54 -0800)
Since ib_copy_from_udata() doesn't check yet the available input data
length before accessing userspace memory, an explicit check of this
length is required to prevent:

- reading past the user provided buffer,
- underflow when subtracting the expected command size from the input
  length.

This will ensure the newly added flow steering uverbs don't try to
process truncated commands.

Link: http://marc.info/?i=cover.1386798254.git.ydroneaud@opteya.com>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
drivers/infiniband/core/uverbs_cmd.c

Simple merge