RDMA/hns: Add a comparision of udata and resp data

driver inclusion
category: bugfix
bugzilla: NA
CVE: NA

If length of udata is less than resp data, it should use the minimum value

Feature or Bugfix:Bugfix
Signed-off-by: Nwangsirong <wangsirong@huawei.com>
Reviewed-by: Nliyangyang20 <liyangyang20@huawei.com>
Reviewed-by: Nhdd.huang <hdd.huang@huawei.com>
Reviewed-by: Nwangxi <wangxi11@huawei.com>
Reviewed-by: Nliuyixian <liuyixian@huawei.com>
Reviewed-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

drivers/infiniband/hw/hns/hns_roce_cq.c

@@ -505,7 +505,7 @@ struct ib_cq *hns_roce_ib_create_cq(struct ib_device *ib_dev,
 
 	if (context) {
 		resp.cqn = hr_cq->cqn;
-		ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
+		ret = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
 		if (ret)
 			goto err_cqc;
 	}

drivers/infiniband/hw/hns/hns_roce_main.c

@@ -556,7 +556,7 @@ static struct ib_ucontext *hns_roce_alloc_ucontext(struct ib_device *ib_dev,
 		mutex_init(&context->page_mutex);
 	}
 
-	ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
+	ret = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
 	if (ret)
 		goto error_fail_copy_to_udata;
 

drivers/infiniband/hw/hns/hns_roce_qp.c

@@ -988,8 +988,8 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
 	else
 		hr_qp->doorbell_qpn = (u32)(hr_qp->qpn);
 
-	if (ib_pd->uobject && (udata->outlen >= sizeof(resp))) {
-		ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
+	if (ib_pd->uobject) {
+		ret = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
 		if (ret)
 			goto err_qp;
 	}