3 files changed, 35 insertions, 17 deletions

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index c3e6811bb1bd..cb1d2ab13c66 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr)
 }
 EXPORT_SYMBOL(rdma_addr_size);
 
+int rdma_addr_size_in6(struct sockaddr_in6 *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_in6);
+
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_kss);
+
 static struct rdma_addr_client self;
 
 void rdma_addr_register_client(struct rdma_addr_client *client)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 21585055cf32..d933336d7e01 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -632,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (!rdma_addr_size_in6(&cmd.addr))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
@@ -645,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf,
                          int in_len, int out_len)
 {
         struct rdma_ucm_bind cmd;
-        struct sockaddr *addr;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        addr = (struct sockaddr *) &cmd.addr;
-        if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr)))
+        if (cmd.reserved || !cmd.addr_size ||
+            cmd.addr_size != rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_bind_addr(ctx->cm_id, addr);
+        ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -670,23 +672,22 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                                int in_len, int out_len)
 {
         struct rdma_ucm_resolve_ip cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+            !rdma_addr_size_in6(&cmd.dst_addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -696,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file,
                                  int in_len, int out_len)
 {
         struct rdma_ucm_resolve_addr cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) ||
-            !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst)))
+        if (cmd.reserved ||
+            (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) ||
+            !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr)))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1433,7 +1433,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
         join_cmd.response = cmd.response;
         join_cmd.uid = cmd.uid;
         join_cmd.id = cmd.id;
-        join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr);
         if (!join_cmd.addr_size)
                 return -EINVAL;
 
@@ -1452,7 +1452,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+        if (!rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         return ucma_process_join(file, &cmd, out_len);
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index d656809f1217..415e09960017 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr *dev_addr,
                     const unsigned char *dst_dev_addr);
 
 int rdma_addr_size(struct sockaddr *addr);
+int rdma_addr_size_in6(struct sockaddr_in6 *addr);
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);
 
 int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
                                  const union ib_gid *dgid,