Merge tag 'for-linus-unmerged' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma...
[muen/linux.git] / drivers / infiniband / core / ucma.c
index d933336..7432948 100644 (file)
@@ -382,7 +382,11 @@ static ssize_t ucma_get_event(struct ucma_file *file, const char __user *inbuf,
        struct ucma_event *uevent;
        int ret = 0;
 
-       if (out_len < sizeof uevent->resp)
+       /*
+        * Old 32 bit user space does not send the 4 byte padding in the
+        * reserved field. We don't care, allow it to keep working.
+        */
+       if (out_len < sizeof(uevent->resp) - sizeof(uevent->resp.reserved))
                return -ENOSPC;
 
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
@@ -416,8 +420,9 @@ static ssize_t ucma_get_event(struct ucma_file *file, const char __user *inbuf,
                uevent->resp.id = ctx->id;
        }
 
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
-                        &uevent->resp, sizeof uevent->resp)) {
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
+                        &uevent->resp,
+                        min_t(size_t, out_len, sizeof(uevent->resp)))) {
                ret = -EFAULT;
                goto done;
        }
@@ -477,15 +482,15 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                return -ENOMEM;
 
        ctx->uid = cmd.uid;
-       cm_id = rdma_create_id(current->nsproxy->net_ns,
-                              ucma_event_handler, ctx, cmd.ps, qp_type);
+       cm_id = __rdma_create_id(current->nsproxy->net_ns,
+                                ucma_event_handler, ctx, cmd.ps, qp_type, NULL);
        if (IS_ERR(cm_id)) {
                ret = PTR_ERR(cm_id);
                goto err1;
        }
 
        resp.id = ctx->id;
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp))) {
                ret = -EFAULT;
                goto err2;
@@ -615,7 +620,7 @@ static ssize_t ucma_destroy_id(struct ucma_file *file, const char __user *inbuf,
        }
 
        resp.events_reported = ucma_free_ctx(ctx);
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp)))
                ret = -EFAULT;
 
@@ -845,7 +850,7 @@ static ssize_t ucma_query_route(struct ucma_file *file,
                ucma_copy_iw_route(&resp, &ctx->cm_id->route);
 
 out:
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp)))
                ret = -EFAULT;
 
@@ -991,7 +996,7 @@ static ssize_t ucma_query(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
 
-       response = (void __user *)(unsigned long) cmd.response;
+       response = u64_to_user_ptr(cmd.response);
        ctx = ucma_get_ctx(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1094,12 +1099,12 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
        if (cmd.conn_param.valid) {
                ucma_copy_conn_param(ctx->cm_id, &conn_param, &cmd.conn_param);
                mutex_lock(&file->mut);
-               ret = rdma_accept(ctx->cm_id, &conn_param);
+               ret = __rdma_accept(ctx->cm_id, &conn_param, NULL);
                if (!ret)
                        ctx->uid = cmd.uid;
                mutex_unlock(&file->mut);
        } else
-               ret = rdma_accept(ctx->cm_id, NULL);
+               ret = __rdma_accept(ctx->cm_id, NULL, NULL);
 
        ucma_put_ctx(ctx);
        return ret;
@@ -1179,7 +1184,7 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
                goto out;
 
        ib_copy_qp_attr_to_user(ctx->cm_id->device, &resp, &qp_attr);
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp)))
                ret = -EFAULT;
 
@@ -1241,6 +1246,9 @@ static int ucma_set_ib_path(struct ucma_context *ctx,
        if (!optlen)
                return -EINVAL;
 
+       if (!ctx->cm_id->device)
+               return -EINVAL;
+
        memset(&sa_path, 0, sizeof(sa_path));
 
        sa_path.rec_type = SA_PATH_REC_TYPE_IB;
@@ -1315,7 +1323,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
                return -EINVAL;
 
-       optval = memdup_user((void __user *) (unsigned long) cmd.optval,
+       optval = memdup_user(u64_to_user_ptr(cmd.optval),
                             cmd.optlen);
        if (IS_ERR(optval)) {
                ret = PTR_ERR(optval);
@@ -1395,7 +1403,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
                goto err2;
 
        resp.id = mc->id;
-       if (copy_to_user((void __user *)(unsigned long) cmd->response,
+       if (copy_to_user(u64_to_user_ptr(cmd->response),
                         &resp, sizeof(resp))) {
                ret = -EFAULT;
                goto err3;
@@ -1500,7 +1508,7 @@ static ssize_t ucma_leave_multicast(struct ucma_file *file,
        resp.events_reported = mc->events_reported;
        kfree(mc);
 
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp)))
                ret = -EFAULT;
 out:
@@ -1587,7 +1595,7 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
        ucma_unlock_files(cur_file, new_file);
 
 response:
-       if (copy_to_user((void __user *)(unsigned long)cmd.response,
+       if (copy_to_user(u64_to_user_ptr(cmd.response),
                         &resp, sizeof(resp)))
                ret = -EFAULT;