1 files changed, 5 insertions, 0 deletions

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index ac2305d8d7c4..08219fb3338b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -674,6 +674,11 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 if (ex_hdr.response) {
                         if (!hdr.out_words && !ex_hdr.provider_out_words)
                                 return -EINVAL;
+
+                        if (!access_ok(VERIFY_WRITE,
+                                       (void __user *) (unsigned long) ex_hdr.response,
+                                       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+                                return -EFAULT;
                 } else {
                         if (hdr.out_words || ex_hdr.provider_out_words)
                                 return -EINVAL;