RDMA/mlx4: Use ib_copy_validate_udata_in()

Follow the last member of each struct at the point
MLX4_IB_UVERBS_ABI_VERSION was set to 4.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 6fef3f1724eb9015b71e93d666f8dedae7272fba..7a6eb602d4a6deac381d5f4445c4a29694c0fe17 100644 (file)
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -168,10 +168,9 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq,
        INIT_LIST_HEAD(&cq->send_qp_list);
        INIT_LIST_HEAD(&cq->recv_qp_list);
 
-       if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) {
-               err = -EFAULT;
+       err = ib_copy_validate_udata_in(udata, ucmd, db_addr);
+       if (err)
                goto err_cq;
-       }
 
        if (ibcq->umem &&
            (dev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_SW_CQ_INIT))
@@ -336,8 +335,9 @@ static int mlx4_alloc_resize_umem(struct mlx4_ib_dev *dev, struct mlx4_ib_cq *cq
        if (cq->resize_umem)
                return -EBUSY;
 
-       if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
-               return -EFAULT;
+       err = ib_copy_validate_udata_in(udata, ucmd, buf_addr);
+       if (err)
+               return err;
 
        cq->resize_buf = kmalloc_obj(*cq->resize_buf);
        if (!cq->resize_buf)

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index b87a4b7949a3a0d6a216a5710af0e4f4b4daad57..deb1b0306aa7a1327bf068326fe3f58ca978a761 100644 (file)
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1053,16 +1053,12 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr,
 
        if (udata) {
                struct mlx4_ib_create_qp ucmd;
-               size_t copy_len;
                int shift;
                int n;
 
-               copy_len = sizeof(struct mlx4_ib_create_qp);
-
-               if (ib_copy_from_udata(&ucmd, udata, copy_len)) {
-                       err = -EFAULT;
+               err = ib_copy_validate_udata_in(udata, ucmd, sq_no_prefetch);
+               if (err)
                        goto err;
-               }
 
                qp->inl_recv_sz = ucmd.inl_recv_sz;
 

diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index c4cf91235eee3a0568fa8054adcba517089d7650..5b23e5f8b84aca5c4f7083d5bd3f720cc1d13320 100644 (file)
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -111,8 +111,9 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq,
        if (udata) {
                struct mlx4_ib_create_srq ucmd;
 
-               if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd)))
-                       return -EFAULT;
+               err = ib_copy_validate_udata_in(udata, ucmd, db_addr);
+               if (err)
+                       return err;
 
                srq->umem =
                        ib_umem_get(ib_srq->device, ucmd.buf_addr, buf_size, 0);