From c8f9a7a96e9a95e7b2bc3cc95371e0d75a5872ec Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Wed, 25 Mar 2026 18:26:52 -0300 Subject: [PATCH] RDMA/mlx5: Use ib_copy_validate_udata_in() for SRQ flags is the last member for mlx5_ib_create_srq, the uidx is a later extension. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky --- drivers/infiniband/hw/mlx5/srq.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c index 17e018554d81..6d89c0242cab 100644 --- a/drivers/infiniband/hw/mlx5/srq.c +++ b/drivers/infiniband/hw/mlx5/srq.c @@ -48,25 +48,16 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq, struct mlx5_ib_create_srq ucmd = {}; struct mlx5_ib_ucontext *ucontext = rdma_udata_to_drv_context( udata, struct mlx5_ib_ucontext, ibucontext); - size_t ucmdlen; int err; u32 uidx = MLX5_IB_DEFAULT_UIDX; - ucmdlen = min(udata->inlen, sizeof(ucmd)); - - if (ib_copy_from_udata(&ucmd, udata, ucmdlen)) { - mlx5_ib_dbg(dev, "failed copy udata\n"); - return -EFAULT; - } + err = ib_copy_validate_udata_in(udata, ucmd, flags); + if (err) + return err; if (ucmd.reserved0 || ucmd.reserved1) return -EINVAL; - if (udata->inlen > sizeof(ucmd) && - !ib_is_udata_cleared(udata, sizeof(ucmd), - udata->inlen - sizeof(ucmd))) - return -EINVAL; - if (in->type != IB_SRQT_BASIC) { err = get_srq_user_index(ucontext, &ucmd, udata->inlen, &uidx); if (err)