lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 331/410] RDMA/ucma: Limit possible option size
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Leon Romanovsky <leonro@mellanox.com>

    commit 6a21dfc0d0db7b7e0acedce67ca533a6eb19283c upstream.

    Users of ucma are supposed to provide size of option level,
    in most paths it is supposed to be equal to u8 or u16, but
    it is not the case for the IB path record, where it can be
    multiple of struct ib_path_rec_data.

    This patch takes simplest possible approach and prevents providing
    values more than possible to allocate.

    Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
    Fixes: 7ce86409adcd ("RDMA/ucma: Allow user space to set service type")
    Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/infiniband/core/ucma.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/infiniband/core/ucma.c
    +++ b/drivers/infiniband/core/ucma.c
    @@ -1187,6 +1187,9 @@ static ssize_t ucma_set_option(struct uc
    if (IS_ERR(ctx))
    return PTR_ERR(ctx);

    + if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
    + return -EINVAL;
    +
    optval = memdup_user((void __user *) (unsigned long) cmd.optval,
    cmd.optlen);
    if (IS_ERR(optval)) {
    \
     
     \ /
      Last update: 2018-06-07 17:53    [W:9.238 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site