diff mbox

[13/22] ucma: ucma_migrate_id(): check output length

Message ID 7a136158088e907914a7bad9a6e4517368cee7e1.1376847403.git.ydroneaud@opteya.com (mailing list archive)
State Rejected
Headers show

Commit Message

Yann Droneaud Aug. 18, 2013, 6:28 p.m. UTC 
Makes ucma_migrate_id() check the length of the output buffer:
this will prevent the function from writing past userspace provided buffer.

Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Link: http://mid.gmane.org/cover.1376847403.git.ydroneaud@opteya.com
---
 drivers/infiniband/core/ucma.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox

Patch

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 9e9e899..a155169 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1478,6 +1478,9 @@  static ssize_t ucma_migrate_id(struct ucma_file *new_file,
 	if (in_len < sizeof(cmd))
 		return -EINVAL;
 
+	if (out_len < sizeof(resp))
+		return -ENOSPC;
+
 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
 		return -EFAULT;