RDMA/irdma: Prevent zero-length STAG registration

Browse source

Currently irdma allows zero-length STAGs to be programmed in HW during
the kernel mode fast register flow. Zero-length MR or STAG registration
disable HW memory length checks.

Improve gaps in bounds checking in irdma by preventing zero-length STAG or
MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set.

This addresses the disclosure CVE-2023-25775.

Fixes: b48c24c2d7 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Christopher Bednarz <christopher.n.bednarz@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

...

This commit is contained in:

Christopher Bednarz 2023-08-18 09:48:38 -05:00 • committed by Leon Romanovsky

parent ed10435d35

commit bb6d73d9ad

3 changed files with 16 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/infiniband/hw/irdma/ctrl.c

View file

2

drivers/infiniband/hw/irdma/type.h

View file

10

drivers/infiniband/hw/irdma/verbs.c

View file