lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 078/496] IB/uverbs: Fix possible oops with duplicate ioctl attributes
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Matan Barak <matanb@mellanox.com>

    [ Upstream commit 4d39a959bc1f3d164b5a54147fdeb19f84b1ed58 ]

    If the same attribute is listed twice by the user in the ioctl attribute
    list then error unwind can cause the kernel to deref garbage.

    This happens when an object with WRITE access is sent twice. The second
    parse properly fails but corrupts the state required for the error unwind
    it triggers.

    Fixing this by making duplicates in the attribute list invalid. This is
    not something we need to support.

    The ioctl interface is currently recommended to be disabled in kConfig.

    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/infiniband/core/uverbs_ioctl.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/infiniband/core/uverbs_ioctl.c
    +++ b/drivers/infiniband/core/uverbs_ioctl.c
    @@ -59,6 +59,9 @@ static int uverbs_process_attr(struct ib
    return 0;
    }

    + if (test_bit(attr_id, attr_bundle_h->valid_bitmap))
    + return -EINVAL;
    +
    spec = &attr_spec_bucket->attrs[attr_id];
    e = &elements[attr_id];
    e->uattr = uattr_ptr;

    \
     
     \ /
      Last update: 2018-05-28 15:41    [W:4.031 / U:0.352 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site