> > Similar to the prior patch, these patterns are open coding an > offsetofend() using sizeof(), which targets the last member of the current > struct. > > Signed-off-by: Jason Gunthorpe <[email protected]>
Reviewed-by: Long Li <[email protected]> > --- > drivers/infiniband/hw/mana/qp.c | 27 +++++++++------------------ > drivers/infiniband/hw/mana/wq.c | 10 ++-------- > drivers/infiniband/hw/mlx4/main.c | 6 ++---- > drivers/infiniband/hw/mlx5/cq.c | 2 +- > drivers/infiniband/sw/rxe/rxe_verbs.c | 13 ++----------- > drivers/infiniband/sw/siw/siw_verbs.c | 6 +----- > 6 files changed, 17 insertions(+), 47 deletions(-) > > diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c > index 82f84f7ad37a90..69c8d4f7a1f46b 100644 > --- a/drivers/infiniband/hw/mana/qp.c > +++ b/drivers/infiniband/hw/mana/qp.c > @@ -111,16 +111,12 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, > struct ib_pd *pd, > u32 port; > int ret; > > - if (!udata || udata->inlen < sizeof(ucmd)) > + if (!udata) > return -EINVAL; > > - ret = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata- > >inlen)); > - if (ret) { > - ibdev_dbg(&mdev->ib_dev, > - "Failed copy from udata for create rss-qp, err %d\n", > - ret); > + ret = ib_copy_validate_udata_in(udata, ucmd, port); > + if (ret) > return ret; > - } > > if (attr->cap.max_recv_wr > mdev->adapter_caps.max_qp_wr) { > ibdev_dbg(&mdev->ib_dev, > @@ -282,15 +278,12 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, > struct ib_pd *ibpd, > u32 port; > int err; > > - if (!mana_ucontext || udata->inlen < sizeof(ucmd)) > + if (!mana_ucontext) > return -EINVAL; > > - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata- > >inlen)); > - if (err) { > - ibdev_dbg(&mdev->ib_dev, > - "Failed to copy from udata create qp-raw, %d\n", err); > + err = ib_copy_validate_udata_in(udata, ucmd, port); > + if (err) > return err; > - } > > if (attr->cap.max_send_wr > mdev->adapter_caps.max_qp_wr) { > ibdev_dbg(&mdev->ib_dev, > @@ -535,17 +528,15 @@ static int mana_ib_create_rc_qp(struct ib_qp *ibqp, > struct ib_pd *ibpd, > u64 flags = 0; > u32 doorbell; > > - if (!udata || udata->inlen < sizeof(ucmd)) > + if (!udata) > return -EINVAL; > > mana_ucontext = rdma_udata_to_drv_context(udata, struct > mana_ib_ucontext, ibucontext); > doorbell = mana_ucontext->doorbell; > flags = MANA_RC_FLAG_NO_FMR; > - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata- > >inlen)); > - if (err) { > - ibdev_dbg(&mdev->ib_dev, "Failed to copy from udata, %d\n", > err); > + err = ib_copy_validate_udata_in(udata, ucmd, queue_size); > + if (err) > return err; > - } > > for (i = 0, j = 0; i < MANA_RC_QUEUE_TYPE_MAX; ++i) { > /* skip FMR for user-level RC QPs */ > diff --git a/drivers/infiniband/hw/mana/wq.c > b/drivers/infiniband/hw/mana/wq.c index 6206244f762e42..aceeea7f17b339 > 100644 > --- a/drivers/infiniband/hw/mana/wq.c > +++ b/drivers/infiniband/hw/mana/wq.c > @@ -15,15 +15,9 @@ struct ib_wq *mana_ib_create_wq(struct ib_pd *pd, > struct mana_ib_wq *wq; > int err; > > - if (udata->inlen < sizeof(ucmd)) > - return ERR_PTR(-EINVAL); > - > - err = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata- > >inlen)); > - if (err) { > - ibdev_dbg(&mdev->ib_dev, > - "Failed to copy from udata for create wq, %d\n", err); > + err = ib_copy_validate_udata_in(udata, ucmd, reserved); > + if (err) > return ERR_PTR(err); > - } > > wq = kzalloc_obj(*wq); > if (!wq) > diff --git a/drivers/infiniband/hw/mlx4/main.c > b/drivers/infiniband/hw/mlx4/main.c > index 73e17b4339eb60..16e4cffbd7a84d 100644 > --- a/drivers/infiniband/hw/mlx4/main.c > +++ b/drivers/infiniband/hw/mlx4/main.c > @@ -50,6 +50,7 @@ > #include <rdma/ib_user_verbs.h> > #include <rdma/ib_addr.h> > #include <rdma/ib_cache.h> > +#include <rdma/uverbs_ioctl.h> > > #include <net/bonding.h> > > @@ -445,10 +446,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev, > struct mlx4_clock_params clock_params; > > if (uhw->inlen) { > - if (uhw->inlen < sizeof(cmd)) > - return -EINVAL; > - > - err = ib_copy_from_udata(&cmd, uhw, sizeof(cmd)); > + err = ib_copy_validate_udata_in(uhw, cmd, reserved); > if (err) > return err; > > diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c > index 643b3b7d387834..f5e75e51c6763f 100644 > --- a/drivers/infiniband/hw/mlx5/cq.c > +++ b/drivers/infiniband/hw/mlx5/cq.c > @@ -1229,7 +1229,7 @@ static int resize_user(struct mlx5_ib_dev *dev, struct > mlx5_ib_cq *cq, > struct ib_umem *umem; > int err; > > - err = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd)); > + err = ib_copy_validate_udata_in(udata, ucmd, reserved1); > if (err) > return err; > > diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c > b/drivers/infiniband/sw/rxe/rxe_verbs.c > index fe41362c51444c..c9fd40bfa09eb2 100644 > --- a/drivers/infiniband/sw/rxe/rxe_verbs.c > +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c > @@ -452,18 +452,9 @@ static int rxe_modify_srq(struct ib_srq *ibsrq, struct > ib_srq_attr *attr, > int err; > > if (udata) { > - if (udata->inlen < sizeof(cmd)) { > - err = -EINVAL; > - rxe_dbg_srq(srq, "malformed udata\n"); > + err = ib_copy_validate_udata_in(udata, cmd, mmap_info_addr); > + if (err) > goto err_out; > - } > - > - err = ib_copy_from_udata(&cmd, udata, sizeof(cmd)); > - if (err) { > - err = -EFAULT; > - rxe_dbg_srq(srq, "unable to read udata\n"); > - goto err_out; > - } > } > > err = rxe_srq_chk_attr(rxe, srq, attr, mask); diff --git > a/drivers/infiniband/sw/siw/siw_verbs.c > b/drivers/infiniband/sw/siw/siw_verbs.c > index ef504db8f2b48b..1e1d262a4ae2db 100644 > --- a/drivers/infiniband/sw/siw/siw_verbs.c > +++ b/drivers/infiniband/sw/siw/siw_verbs.c > @@ -1373,11 +1373,7 @@ struct ib_mr *siw_reg_user_mr(struct ib_pd *pd, u64 > start, u64 len, > struct siw_uresp_reg_mr uresp = {}; > struct siw_mem *mem = mr->mem; > > - if (udata->inlen < sizeof(ureq)) { > - rv = -EINVAL; > - goto err_out; > - } > - rv = ib_copy_from_udata(&ureq, udata, sizeof(ureq)); > + rv = ib_copy_validate_udata_in(udata, ureq, pad); > if (rv) > goto err_out; > > -- > 2.43.0
