aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/infiniband/core/ucm.c2
-rw-r--r--drivers/infiniband/core/ucma.c2
-rw-r--r--drivers/infiniband/core/user_mad.c5
-rw-r--r--drivers/infiniband/core/uverbs_main.c3
4 files changed, 5 insertions, 7 deletions
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 08f948df8fa..b8a0b4a7811 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1122,7 +1122,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
1122 if (copy_from_user(&hdr, buf, sizeof(hdr))) 1122 if (copy_from_user(&hdr, buf, sizeof(hdr)))
1123 return -EFAULT; 1123 return -EFAULT;
1124 1124
1125 if (hdr.cmd < 0 || hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) 1125 if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
1126 return -EINVAL; 1126 return -EINVAL;
1127 1127
1128 if (hdr.in + sizeof(hdr) > len) 1128 if (hdr.in + sizeof(hdr) > len)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 71be5eebd68..b3f3dddd528 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1270,7 +1270,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
1270 if (copy_from_user(&hdr, buf, sizeof(hdr))) 1270 if (copy_from_user(&hdr, buf, sizeof(hdr)))
1271 return -EFAULT; 1271 return -EFAULT;
1272 1272
1273 if (hdr.cmd < 0 || hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) 1273 if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table))
1274 return -EINVAL; 1274 return -EINVAL;
1275 1275
1276 if (hdr.in + sizeof(hdr) > len) 1276 if (hdr.in + sizeof(hdr) > len)
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 8d261b6ea5f..07db22997e9 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -458,8 +458,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
458 goto err; 458 goto err;
459 } 459 }
460 460
461 if (packet->mad.hdr.id < 0 || 461 if (packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) {
462 packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) {
463 ret = -EINVAL; 462 ret = -EINVAL;
464 goto err; 463 goto err;
465 } 464 }
@@ -703,7 +702,7 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
703 mutex_lock(&file->port->file_mutex); 702 mutex_lock(&file->port->file_mutex);
704 mutex_lock(&file->mutex); 703 mutex_lock(&file->mutex);
705 704
706 if (id < 0 || id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) { 705 if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
707 ret = -EINVAL; 706 ret = -EINVAL;
708 goto out; 707 goto out;
709 } 708 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 56898b6578a..7c30e1e12c9 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -557,8 +557,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
557 if (hdr.in_words * 4 != count) 557 if (hdr.in_words * 4 != count)
558 return -EINVAL; 558 return -EINVAL;
559 559
560 if (hdr.command < 0 || 560 if (hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
561 hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
562 !uverbs_cmd_table[hdr.command]) 561 !uverbs_cmd_table[hdr.command])
563 return -EINVAL; 562 return -EINVAL;
564 563