diff options
| -rw-r--r-- | drivers/infiniband/core/ucm.c | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c index 46474842cfe..08f948df8fa 100644 --- a/drivers/infiniband/core/ucm.c +++ b/drivers/infiniband/core/ucm.c | |||
| @@ -706,14 +706,9 @@ static int ib_ucm_alloc_data(const void **dest, u64 src, u32 len) | |||
| 706 | if (!len) | 706 | if (!len) |
| 707 | return 0; | 707 | return 0; |
| 708 | 708 | ||
| 709 | data = kmalloc(len, GFP_KERNEL); | 709 | data = memdup_user((void __user *)(unsigned long)src, len); |
| 710 | if (!data) | 710 | if (IS_ERR(data)) |
| 711 | return -ENOMEM; | 711 | return PTR_ERR(data); |
| 712 | |||
| 713 | if (copy_from_user(data, (void __user *)(unsigned long)src, len)) { | ||
| 714 | kfree(data); | ||
| 715 | return -EFAULT; | ||
| 716 | } | ||
| 717 | 712 | ||
| 718 | *dest = data; | 713 | *dest = data; |
| 719 | return 0; | 714 | return 0; |
