diff options
Diffstat (limited to 'include/rdma/ib_verbs.h')
-rw-r--r-- | include/rdma/ib_verbs.h | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 8e90dd28bb75..e1f96737c2a1 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h | |||
@@ -2115,22 +2115,17 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata, | |||
2115 | size_t len) | 2115 | size_t len) |
2116 | { | 2116 | { |
2117 | const void __user *p = udata->inbuf + offset; | 2117 | const void __user *p = udata->inbuf + offset; |
2118 | bool ret = false; | 2118 | bool ret; |
2119 | u8 *buf; | 2119 | u8 *buf; |
2120 | 2120 | ||
2121 | if (len > USHRT_MAX) | 2121 | if (len > USHRT_MAX) |
2122 | return false; | 2122 | return false; |
2123 | 2123 | ||
2124 | buf = kmalloc(len, GFP_KERNEL); | 2124 | buf = memdup_user(p, len); |
2125 | if (!buf) | 2125 | if (IS_ERR(buf)) |
2126 | return false; | 2126 | return false; |
2127 | 2127 | ||
2128 | if (copy_from_user(buf, p, len)) | ||
2129 | goto free; | ||
2130 | |||
2131 | ret = !memchr_inv(buf, 0, len); | 2128 | ret = !memchr_inv(buf, 0, len); |
2132 | |||
2133 | free: | ||
2134 | kfree(buf); | 2129 | kfree(buf); |
2135 | return ret; | 2130 | return ret; |
2136 | } | 2131 | } |