is_rnic_cq = mana_ib_is_rnic(mdev);
if (udata) {
- if (udata->inlen < offsetof(struct mana_ib_create_cq, flags))
- return -EINVAL;
-
- err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen));
- if (err) {
- ibdev_dbg(ibdev, "Failed to copy from udata for create cq, %d\n", err);
+ err = ib_copy_validate_udata_in(udata, ucmd, buf_addr);
+ if (err)
return err;
- }
if ((!is_rnic_cq && attr->cqe > mdev->adapter_caps.max_qp_wr) ||
attr->cqe > U32_MAX / COMP_ENTRY_SIZE) {
struct mlx5_ib_create_cq ucmd = {};
unsigned long page_size;
unsigned int page_offset_quantized;
- size_t ucmdlen;
__be64 *pas;
int ncont;
void *cqc;
struct mlx5_ib_ucontext *context = rdma_udata_to_drv_context(
udata, struct mlx5_ib_ucontext, ibucontext);
- ucmdlen = min(udata->inlen, sizeof(ucmd));
- if (ucmdlen < offsetof(struct mlx5_ib_create_cq, flags))
- return -EINVAL;
-
- if (ib_copy_from_udata(&ucmd, udata, ucmdlen))
- return -EFAULT;
+ err = ib_copy_validate_udata_in(udata, ucmd, cqe_comp_res_format);
+ if (err)
+ return err;
if ((ucmd.flags & ~(MLX5_IB_CREATE_CQ_FLAGS_CQE_128B_PAD |
MLX5_IB_CREATE_CQ_FLAGS_UAR_PAGE_INDEX |