RDMA/hfi1: Copy userspace arrays safely

Currently, memdup_user() is utilized at two positions to copy userspace
arrays. This is done without overflow checks.

Use the new wrapper memdup_array_user() to copy the arrays more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Link: https://lore.kernel.org/r/20231102191308.52046-2-pstanner@redhat.com
Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
index 6419872..cf2d290 100644 (file)
--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
@@ -491,8 +491,8 @@ int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd,
        if (unlikely(tinfo->tidcnt > fd->tid_used))
                return -EINVAL;
 
-       tidinfo = memdup_user(u64_to_user_ptr(tinfo->tidlist),
-                             sizeof(tidinfo[0]) * tinfo->tidcnt);
+       tidinfo = memdup_array_user(u64_to_user_ptr(tinfo->tidlist),
+                                   tinfo->tidcnt, sizeof(tidinfo[0]));
        if (IS_ERR(tidinfo))
                return PTR_ERR(tidinfo);
 

diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 6a4aa59..b726252 100644 (file)
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -494,8 +494,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
                 * equal to the pkt count. However, there is no way to
                 * tell at this point.
                 */
-               tmp = memdup_user(iovec[idx].iov_base,
-                                 ntids * sizeof(*req->tids));
+               tmp = memdup_array_user(iovec[idx].iov_base,
+                                       ntids, sizeof(*req->tids));
                if (IS_ERR(tmp)) {
                        ret = PTR_ERR(tmp);
                        SDMA_DBG(req, "Failed to copy %d TIDs (%d)",