diff options
| author | Dean Luick <dean.luick@cornelisnetworks.com> | 2023-01-09 18:31:11 +0100 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2023-01-10 11:21:49 +0100 |
| commit | 0a0a6e80472c98947d73c3d13bcd7d101895f55d (patch) | |
| tree | e69bdfa33968e06100203df99d77f4c47e88ec60 /drivers/infiniband | |
| parent | RDMA/core: Fix ib block iterator counter overflow (diff) | |
| download | linux-0a0a6e80472c98947d73c3d13bcd7d101895f55d.tar.xz linux-0a0a6e80472c98947d73c3d13bcd7d101895f55d.zip | |
IB/hfi1: Reject a zero-length user expected buffer
A zero length user buffer makes no sense and the code
does not handle it correctly. Instead, reject a
zero length as invalid.
Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres")
Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Link: https://lore.kernel.org/r/167328547120.1472310.6362802432127399257.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/user_exp_rcv.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c index 186d30291260..3c609b11e71c 100644 --- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c +++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c @@ -256,6 +256,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, if (!PAGE_ALIGNED(tinfo->vaddr)) return -EINVAL; + if (tinfo->length == 0) + return -EINVAL; tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL); if (!tidbuf) |