if (err)
goto err_out;
- if (offsetofend(typeof(cmd), driver_qp_type) > udata->inlen) {
- ibdev_dbg(&dev->ibdev,
- "Incompatible ABI params, no input udata\n");
- err = -EINVAL;
- goto err_out;
- }
-
- if (udata->inlen > sizeof(cmd) &&
- !ib_is_udata_cleared(udata, sizeof(cmd),
- udata->inlen - sizeof(cmd))) {
- ibdev_dbg(&dev->ibdev,
- "Incompatible ABI params, unknown fields in udata\n");
- err = -EINVAL;
- goto err_out;
- }
-
- err = ib_copy_from_udata(&cmd, udata,
- min(sizeof(cmd), udata->inlen));
- if (err) {
- ibdev_dbg(&dev->ibdev,
- "Cannot copy udata for create_qp\n");
+ err = ib_copy_validate_udata_in(udata, cmd, driver_qp_type);
+ if (err)
goto err_out;
- }
if (cmd.comp_mask || !is_reserved_cleared(cmd.reserved_98)) {
ibdev_dbg(&dev->ibdev,
goto err_out;
}
- if (offsetofend(typeof(cmd), num_sub_cqs) > udata->inlen) {
- ibdev_dbg(ibdev,
- "Incompatible ABI params, no input udata\n");
- err = -EINVAL;
- goto err_out;
- }
-
- if (udata->inlen > sizeof(cmd) &&
- !ib_is_udata_cleared(udata, sizeof(cmd),
- udata->inlen - sizeof(cmd))) {
- ibdev_dbg(ibdev,
- "Incompatible ABI params, unknown fields in udata\n");
- err = -EINVAL;
- goto err_out;
- }
-
- err = ib_copy_from_udata(&cmd, udata,
- min(sizeof(cmd), udata->inlen));
- if (err) {
- ibdev_dbg(ibdev, "Cannot copy udata for create_cq\n");
+ err = ib_copy_validate_udata_in(udata, cmd, num_sub_cqs);
+ if (err)
goto err_out;
- }
if (cmd.comp_mask || !is_reserved_cleared(cmd.reserved_58)) {
ibdev_dbg(ibdev,
static int irdma_alloc_ucontext(struct ib_ucontext *uctx,
struct ib_udata *udata)
{
-#define IRDMA_ALLOC_UCTX_MIN_REQ_LEN offsetofend(struct irdma_alloc_ucontext_req, rsvd8)
#define IRDMA_ALLOC_UCTX_MIN_RESP_LEN offsetofend(struct irdma_alloc_ucontext_resp, rsvd)
struct ib_device *ibdev = uctx->device;
struct irdma_device *iwdev = to_iwdev(ibdev);
struct irdma_alloc_ucontext_resp uresp = {};
struct irdma_ucontext *ucontext = to_ucontext(uctx);
struct irdma_uk_attrs *uk_attrs = &iwdev->rf->sc_dev.hw_attrs.uk_attrs;
+ int ret;
- if (udata->inlen < IRDMA_ALLOC_UCTX_MIN_REQ_LEN ||
- udata->outlen < IRDMA_ALLOC_UCTX_MIN_RESP_LEN)
+ if (udata->outlen < IRDMA_ALLOC_UCTX_MIN_RESP_LEN)
return -EINVAL;
- if (ib_copy_from_udata(&req, udata, min(sizeof(req), udata->inlen)))
- return -EINVAL;
+ ret = ib_copy_validate_udata_in(udata, req, rsvd8);
+ if (ret)
+ return ret;
if (req.userspace_ver < 4 || req.userspace_ver > IRDMA_ABI_VER)
goto ver_error;
struct ib_udata *udata)
{
struct mlx4_ib_create_qp_rss ucmd = {};
- size_t required_cmd_sz;
int err;
if (!udata) {
if (udata->outlen)
return -EOPNOTSUPP;
- required_cmd_sz = offsetof(typeof(ucmd), reserved1) +
- sizeof(ucmd.reserved1);
- if (udata->inlen < required_cmd_sz) {
- pr_debug("invalid inlen\n");
- return -EINVAL;
- }
-
- if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen))) {
+ err = ib_copy_validate_udata_in(udata, ucmd, reserved1);
+ if (err) {
pr_debug("copy failed\n");
- return -EFAULT;
+ return err;
}
if (memchr_inv(ucmd.reserved, 0, sizeof(ucmd.reserved)))
if (ucmd.comp_mask || ucmd.reserved1)
return -EOPNOTSUPP;
- if (udata->inlen > sizeof(ucmd) &&
- !ib_is_udata_cleared(udata, sizeof(ucmd),
- udata->inlen - sizeof(ucmd))) {
- pr_debug("inlen is not supported\n");
- return -EOPNOTSUPP;
- }
-
if (init_attr->qp_type != IB_QPT_RAW_PACKET) {
pr_debug("RSS QP with unsupported QP type %d\n",
init_attr->qp_type);
{
struct mlx4_ib_qp *qp = to_mqp((struct ib_qp *)ibwq);
struct mlx4_ib_modify_wq ucmd = {};
- size_t required_cmd_sz;
enum ib_wq_state cur_state, new_state;
- int err = 0;
-
- required_cmd_sz = offsetof(typeof(ucmd), reserved) +
- sizeof(ucmd.reserved);
- if (udata->inlen < required_cmd_sz)
- return -EINVAL;
-
- if (udata->inlen > sizeof(ucmd) &&
- !ib_is_udata_cleared(udata, sizeof(ucmd),
- udata->inlen - sizeof(ucmd)))
- return -EOPNOTSUPP;
+ int err;
- if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)))
- return -EFAULT;
+ err = ib_copy_validate_udata_in(udata, ucmd, reserved);
+ if (err)
+ return err;
if (ucmd.comp_mask || ucmd.reserved)
return -EOPNOTSUPP;
return -ENOSYS;
if (udata && udata->inlen) {
- if (udata->inlen < offsetofend(typeof(ucmd), ece_options))
- return -EINVAL;
-
- if (udata->inlen > sizeof(ucmd) &&
- !ib_is_udata_cleared(udata, sizeof(ucmd),
- udata->inlen - sizeof(ucmd)))
- return -EOPNOTSUPP;
-
- if (ib_copy_from_udata(&ucmd, udata,
- min(udata->inlen, sizeof(ucmd))))
- return -EFAULT;
+ err = ib_copy_validate_udata_in(udata, ucmd, ece_options);
+ if (err)
+ return err;
if (ucmd.comp_mask & ~MLX5_IB_MODIFY_QP_OOO_DP ||
memchr_inv(&ucmd.burst_info.reserved, 0,
struct mlx5_ib_dev *dev = to_mdev(pd->device);
struct mlx5_ib_create_wq ucmd = {};
int err;
- size_t required_cmd_sz;
-
- required_cmd_sz = offsetofend(struct mlx5_ib_create_wq,
- single_stride_log_num_of_bytes);
- if (udata->inlen < required_cmd_sz) {
- mlx5_ib_dbg(dev, "invalid inlen\n");
- return -EINVAL;
- }
-
- if (udata->inlen > sizeof(ucmd) &&
- !ib_is_udata_cleared(udata, sizeof(ucmd),
- udata->inlen - sizeof(ucmd))) {
- mlx5_ib_dbg(dev, "inlen is not supported\n");
- return -EOPNOTSUPP;
- }
-
- if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen))) {
+ err = ib_copy_validate_udata_in(udata, ucmd,
+ single_stride_log_num_of_bytes);
+ if (err) {
mlx5_ib_dbg(dev, "copy failed\n");
- return -EFAULT;
+ return err;
}
if (ucmd.comp_mask & (~MLX5_IB_CREATE_WQ_STRIDING_RQ)) {
struct mlx5_ib_dev *dev = to_mdev(wq->device);
struct mlx5_ib_rwq *rwq = to_mrwq(wq);
struct mlx5_ib_modify_wq ucmd = {};
- size_t required_cmd_sz;
int curr_wq_state;
int wq_state;
int inlen;
void *rqc;
void *in;
- required_cmd_sz = offsetofend(struct mlx5_ib_modify_wq, reserved);
- if (udata->inlen < required_cmd_sz)
- return -EINVAL;
-
- if (udata->inlen > sizeof(ucmd) &&
- !ib_is_udata_cleared(udata, sizeof(ucmd),
- udata->inlen - sizeof(ucmd)))
- return -EOPNOTSUPP;
-
- if (ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen)))
- return -EFAULT;
+ err = ib_copy_validate_udata_in(udata, ucmd, reserved);
+ if (err)
+ return err;
if (ucmd.comp_mask || ucmd.reserved)
return -EOPNOTSUPP;