IB/rdmavt: Don't abuse udata and ib_respond_udata()

Use copy_to_user() directly since the data is not being placed in the
udata response memory.

It is unclear why this is trying to do two copies, but leave it alone.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/sw/rdmavt/srq.c b/drivers/infiniband/sw/rdmavt/srq.c
index fe125bf85b2726eb27a4bf7a56705ae20ece0fec..d022aa56c5bfd53b628ae93c959177170089bf08 100644 (file)
--- a/drivers/infiniband/sw/rdmavt/srq.c
+++ b/drivers/infiniband/sw/rdmavt/srq.c
@@ -128,6 +128,7 @@ int rvt_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
        struct rvt_srq *srq = ibsrq_to_rvtsrq(ibsrq);
        struct rvt_dev_info *dev = ib_to_rvt(ibsrq->device);
        struct rvt_rq tmp_rq = {};
+       __u64 offset_addr;
        int ret = 0;
 
        if (attr_mask & IB_SRQ_MAX_WR) {
@@ -149,19 +150,17 @@ int rvt_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                        return -ENOMEM;
                /* Check that we can write the offset to mmap. */
                if (udata && udata->inlen >= sizeof(__u64)) {
-                       __u64 offset_addr;
                        __u64 offset = 0;
 
                        ret = ib_copy_from_udata(&offset_addr, udata,
                                                 sizeof(offset_addr));
                        if (ret)
                                goto bail_free;
-                       udata->outbuf = (void __user *)
-                                       (unsigned long)offset_addr;
-                       ret = ib_copy_to_udata(udata, &offset,
-                                              sizeof(offset));
-                       if (ret)
+                       if (copy_to_user(u64_to_user_ptr(offset_addr), &offset,
+                                        sizeof(offset))) {
+                               ret = -EFAULT;
                                goto bail_free;
+                       }
                }
 
                spin_lock_irq(&srq->rq.kwq->c_lock);
@@ -236,10 +235,10 @@ int rvt_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
                         * See rvt_mmap() for details.
                         */
                        if (udata && udata->inlen >= sizeof(__u64)) {
-                               ret = ib_copy_to_udata(udata, &ip->offset,
-                                                      sizeof(ip->offset));
-                               if (ret)
-                                       return ret;
+                               if (copy_to_user(u64_to_user_ptr(offset_addr),
+                                                &ip->offset,
+                                                sizeof(ip->offset)))
+                                       return -EFAULT;
                        }
 
                        /*