RDMA/hns: Limit the length of data copied between kernel and userspace

Browse source

For ib_copy_from_user(), the length of udata may not be the same as that
of cmd. For ib_copy_to_user(), the length of udata may not be the same as
that of resp. So limit the length to prevent out-of-bounds read and write
operations from ib_copy_from_user() and ib_copy_to_user().

Fixes: de77503a59 ("RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db")
Fixes: 633fb4d9fd ("RDMA/hns: Use structs to describe the uABI instead of opencoding")
Fixes: ae85bf92ef ("RDMA/hns: Optimize qp param setup flow")
Fixes: 6fd610c573 ("RDMA/hns: Support 0 hop addressing for SRQ buffer")
Fixes: 9d9d4ff788 ("RDMA/hns: Update the kernel header file of hns")
Link: https://lore.kernel.org/r/1607650657-35992-2-git-send-email-liweihang@huawei.com
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

...

This commit is contained in:

Wenpeng Liang 2020-12-11 09:37:27 +08:00 • committed by Jason Gunthorpe

parent 6f320f6990

commit 1c0ca9cd17

5 changed files with 22 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/infiniband/hw/hns/hns_roce_cq.c

View file

3

drivers/infiniband/hw/hns/hns_roce_main.c

View file

11

drivers/infiniband/hw/hns/hns_roce_pd.c

View file

9

drivers/infiniband/hw/hns/hns_roce_qp.c

View file

10

drivers/infiniband/hw/hns/hns_roce_srq.c

View file