diff options
| author | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2018-12-12 14:08:45 +0100 |
|---|---|---|
| committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2018-12-12 14:08:45 +0100 |
| commit | cfbbc7703fff59c67761c93a8b1de29a79f9841c (patch) | |
| tree | 58b4b37bed385b27fc5956435b2451c760f26f5f /drivers/infiniband/core/ucm.c | |
| parent | 5f3fecbc0715a70437501e1d85e74726c4f561be (diff) | |
| parent | 1aa861ff238ecd17a3095b0dbd2d20bdf7bfaf14 (diff) | |
Merge tag 'v4.9.144' into 4.9-2.3.x-imx
This is the 4.9.144 stable release
Diffstat (limited to 'drivers/infiniband/core/ucm.c')
| -rw-r--r-- | drivers/infiniband/core/ucm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c index 7713ef089c3c..85be45e75710 100644 --- a/drivers/infiniband/core/ucm.c +++ b/drivers/infiniband/core/ucm.c @@ -46,6 +46,8 @@ #include <linux/mutex.h> #include <linux/slab.h> +#include <linux/nospec.h> + #include <asm/uaccess.h> #include <rdma/ib.h> @@ -1115,6 +1117,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) return -EINVAL; + hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucm_cmd_table)); if (hdr.in + sizeof(hdr) > len) return -EINVAL; |