diff options
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/infiniband/core/ucm.c | 2 | ||||
-rw-r--r-- | drivers/infiniband/core/ucma.c | 2 | ||||
-rw-r--r-- | drivers/infiniband/core/user_mad.c | 5 | ||||
-rw-r--r-- | drivers/infiniband/core/uverbs_main.c | 3 |
4 files changed, 5 insertions, 7 deletions
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c index 08f948df8fa9..b8a0b4a7811b 100644 --- a/drivers/infiniband/core/ucm.c +++ b/drivers/infiniband/core/ucm.c | |||
@@ -1122,7 +1122,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, | |||
1122 | if (copy_from_user(&hdr, buf, sizeof(hdr))) | 1122 | if (copy_from_user(&hdr, buf, sizeof(hdr))) |
1123 | return -EFAULT; | 1123 | return -EFAULT; |
1124 | 1124 | ||
1125 | if (hdr.cmd < 0 || hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) | 1125 | if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) |
1126 | return -EINVAL; | 1126 | return -EINVAL; |
1127 | 1127 | ||
1128 | if (hdr.in + sizeof(hdr) > len) | 1128 | if (hdr.in + sizeof(hdr) > len) |
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 71be5eebd683..b3f3dddd528d 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c | |||
@@ -1270,7 +1270,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, | |||
1270 | if (copy_from_user(&hdr, buf, sizeof(hdr))) | 1270 | if (copy_from_user(&hdr, buf, sizeof(hdr))) |
1271 | return -EFAULT; | 1271 | return -EFAULT; |
1272 | 1272 | ||
1273 | if (hdr.cmd < 0 || hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) | 1273 | if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) |
1274 | return -EINVAL; | 1274 | return -EINVAL; |
1275 | 1275 | ||
1276 | if (hdr.in + sizeof(hdr) > len) | 1276 | if (hdr.in + sizeof(hdr) > len) |
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index 8d261b6ea5fe..07db22997e97 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c | |||
@@ -458,8 +458,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, | |||
458 | goto err; | 458 | goto err; |
459 | } | 459 | } |
460 | 460 | ||
461 | if (packet->mad.hdr.id < 0 || | 461 | if (packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) { |
462 | packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) { | ||
463 | ret = -EINVAL; | 462 | ret = -EINVAL; |
464 | goto err; | 463 | goto err; |
465 | } | 464 | } |
@@ -703,7 +702,7 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg) | |||
703 | mutex_lock(&file->port->file_mutex); | 702 | mutex_lock(&file->port->file_mutex); |
704 | mutex_lock(&file->mutex); | 703 | mutex_lock(&file->mutex); |
705 | 704 | ||
706 | if (id < 0 || id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) { | 705 | if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) { |
707 | ret = -EINVAL; | 706 | ret = -EINVAL; |
708 | goto out; | 707 | goto out; |
709 | } | 708 | } |
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c index 56898b6578a4..7c30e1e12c90 100644 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c | |||
@@ -557,8 +557,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, | |||
557 | if (hdr.in_words * 4 != count) | 557 | if (hdr.in_words * 4 != count) |
558 | return -EINVAL; | 558 | return -EINVAL; |
559 | 559 | ||
560 | if (hdr.command < 0 || | 560 | if (hdr.command >= ARRAY_SIZE(uverbs_cmd_table) || |
561 | hdr.command >= ARRAY_SIZE(uverbs_cmd_table) || | ||
562 | !uverbs_cmd_table[hdr.command]) | 561 | !uverbs_cmd_table[hdr.command]) |
563 | return -EINVAL; | 562 | return -EINVAL; |
564 | 563 | ||