RDMA/hfi1: Copy userspace arrays safely
authorPhilipp Stanner <pstanner@redhat.com>
Thu, 2 Nov 2023 19:13:09 +0000 (20:13 +0100)
committerLeon Romanovsky <leon@kernel.org>
Mon, 13 Nov 2023 08:21:33 +0000 (10:21 +0200)
commitc170d4ff21a8a525d782e3d1bc58d9538d95afe6
tree306432a287d74b2d41ed82a4df6a6ae3c6e7d274
parent476b7c7e00ec3d909bacaeaf1dc53eb2b2d0c41d
RDMA/hfi1: Copy userspace arrays safely

Currently, memdup_user() is utilized at two positions to copy userspace
arrays. This is done without overflow checks.

Use the new wrapper memdup_array_user() to copy the arrays more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Link: https://lore.kernel.org/r/20231102191308.52046-2-pstanner@redhat.com
Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
drivers/infiniband/hw/hfi1/user_exp_rcv.c
drivers/infiniband/hw/hfi1/user_sdma.c