Merge branch 'uverbs_dev_cleanups' into rdma.git for-next

For dependencies, branch based on rdma.git 'for-rc' of
https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/

Pull 'uverbs_dev_cleanups' from Leon Romanovsky:

====================
Reuse the char device code interfaces to simplify ib_uverbs_device
creation and destruction. As part of this series, we are sending fix to
cleanup path, which was discovered during internal review,

The fix definitely can go to -rc, but it means that this series will be
dependent on rdma-rc.
====================

* branch 'uverbs_dev_cleanups':
  RDMA/uverbs: Use device.groups to initialize device attributes
  RDMA/uverbs: Use cdev_device_add() instead of cdev_add()
  RDMA/core: Depend on device_add() to add device attributes
  RDMA/uverbs: Fix error cleanup path of ib_uverbs_add_one()

Resolved conflict in ib_device_unregister_sysfs()

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d5d2a6dc3921..f218ccf1e2d9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -914,6 +914,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_U32_MAX + 1];
         u32 htid, flags = 0;
+        size_t sel_size;
         int err;
 #ifdef CONFIG_CLS_U32_PERF
         size_t size;
@@ -1076,8 +1077,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         }
 
         s = nla_data(tb[TCA_U32_SEL]);
+        sel_size = struct_size(s, keys, s->nkeys);
+        if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
+                err = -EINVAL;
+                goto erridr;
+        }
 
-        n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+        n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);
         if (n == NULL) {
                 err = -ENOBUFS;
                 goto erridr;
@@ -1092,7 +1098,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         }
 #endif
 
-        memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
+        memcpy(&n->sel, s, sel_size);
         RCU_INIT_POINTER(n->ht_up, ht);
         n->handle = handle;
         n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;