On Thu, Sep 19, 2019 at 08:24:56PM +0000, Adit Ranadive wrote: > > + if (!qp->is_kernel) { > + if (ucmd.flags == PVRDMA_USER_QP_CREATE_USE_RESP) { Why does this flag exist? Don't old userspaces pass in a 0 length? Just use the length to signal new userspace? > + qp_resp.qpn = qp->ibqp.qp_num; > + qp_resp.qp_handle = qp->qp_handle; > + qp_resp.qpn_valid = PVRDMA_USER_QP_CREATE_USE_RESP; > + > + if (ib_copy_to_udata(udata, &qp_resp, > + sizeof(qp_resp))) { This should limit the copy size to the length of the user buffer Jason