Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1684459

[PATCH 4.12 02/27] RDMA/uverbs: Check port number supplied by user verbs cmds

Show all headers | View raw

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boris Pismenny <borisp@mellanox.com>

commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.

The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
the port number from user input as part of its attributes and assumes
it is valid. Down on the stack, that parameter is used to access kernel
data structures.  If the value is invalid, the kernel accesses memory
it should not.  To prevent this, verify the port number before using it.

BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313

BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819

Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Fixes: 189aba99e70 ("IB/uverbs: Extend modify_qp and support packet pacing")
Cc: Yevgeny Kliteynik <kliteyn@mellanox.com>
Cc: Tziporet Koren <tziporet@mellanox.com>
Cc: Alex Polak <alexpo@mellanox.com>
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/uverbs_cmd.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1931,6 +1931,11 @@ static int modify_qp(struct ib_uverbs_fi
 		goto out;
 	}
 
+	if (!rdma_is_port_valid(qp->device, cmd->base.port_num)) {
+		ret = -EINVAL;
+		goto release_qp;
+	}
+
 	attr->qp_state		  = cmd->base.qp_state;
 	attr->cur_qp_state	  = cmd->base.cur_qp_state;
 	attr->path_mtu		  = cmd->base.path_mtu;
@@ -2541,6 +2546,9 @@ ssize_t ib_uverbs_create_ah(struct ib_uv
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
+	if (!rdma_is_port_valid(ib_dev, cmd.attr.port_num))
+		return -EINVAL;
+
 	INIT_UDATA(&udata, buf + sizeof(cmd),
 		   (unsigned long)cmd.response + sizeof(resp),
 		   in_len - sizeof(cmd), out_len - sizeof(resp));

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.12 00/27] 4.12.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 14/27] tpm: Issue a TPM2_Shutdown for TPM2 devices. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 26/27] xen: avoid deadlock in xenbus driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 05/27] usb: usbip: set buffer pointers to NULL after free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 02/27] RDMA/uverbs: Check port number supplied by user verbs cmds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 19/27] sched/core: Implement new approach to scale select_idle_cpu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 01/27] driver core: platform: fix race condition with driver_override Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 06/27] Add USB quirk for HVR-950q to avoid intermittent device resets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:20 +0200
  [PATCH 4.12 25/27] sched/numa: Hide numa_wake_affine() from UP build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:30 +0200
  [PATCH 4.12 17/27] x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:30 +0200
  [PATCH 4.12 04/27] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 13/27] Add "shutdown" to "struct class". Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 11/27] xhci: Limit USB2 port wake support for AMD Promontory hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 18/27] sched/fair, cpumask: Export for_each_cpu_wrap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 23/27] sched/numa: Implement NUMA node level wake_affine() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 24/27] sched/fair: Remove effective_load() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 15/27] tpm: fix a kernel memory leak in tpm-sysfs.c Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 20/27] sched/numa: Use down_read_trylock() for the mmap_sem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 08/27] USB: core: fix device node leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 12/27] gfs2: Fix glock rhashtable rcu bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 03/27] usb: dwc3: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 27/27] crypto: drbg - Fixes panic in wait_for_completion call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 22/27] sched/fair: Simplify wake_affine() for the single socket case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  [PATCH 4.12 07/27] usb: Fix typo in the definition of Endpoint[out]Request Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-10 19:40 +0200
  Re: [PATCH 4.12 00/27] 4.12.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-11 03:30 +0200
    Re: [PATCH 4.12 00/27] 4.12.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-11 11:50 +0200

csiph-web