RDMA/uverbs: Fail as early as possible if not enough header data was provided

Fail as early as possible if not enough header data
was provided.

Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index d28b6f1543c71620323bca7f9b42f98086ed57d7..2189a26bbe6401d3e6e4fe8f9053a39c0d4ecef5 100644 (file)
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -662,6 +662,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                             size_t count, loff_t *pos)
 {
        struct ib_uverbs_file *file = filp->private_data;
+       struct ib_uverbs_ex_cmd_hdr ex_hdr;
        struct ib_device *ib_dev;
        struct ib_uverbs_cmd_hdr hdr;
        bool extended_command;
@@ -706,6 +707,12 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                goto out;
        }
 
+       if (extended_command &&
+           count < (sizeof(hdr) + sizeof(ex_hdr))) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        if (!verify_command_idx(command, extended_command)) {
                ret = -EINVAL;
                goto out;
@@ -738,7 +745,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                 hdr.in_words * 4,
                                                 hdr.out_words * 4);
        } else {
-               struct ib_uverbs_ex_cmd_hdr ex_hdr;
                struct ib_udata ucore;
                struct ib_udata uhw;
                size_t written_count = count;
@@ -753,11 +759,6 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                        goto out;
                }
 
-               if (count < (sizeof(hdr) + sizeof(ex_hdr))) {
-                       ret = -EINVAL;
-                       goto out;
-               }
-
                if (copy_from_user(&ex_hdr, buf + sizeof(hdr), sizeof(ex_hdr))) {
                        ret = -EFAULT;
                        goto out;