kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/rdma
History
Jason Gunthorpe c92003c18f IB/security: Restrict use of the write() interface 
commit e6bd18f57a upstream.

The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
[ Expanded check to all known write() entry points ]
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2016-05-04 14:48:48 -07:00
..
amso1100 Initial 4.4 merge window submission 2015-11-07 13:33:07 -08:00
ehca Initial 4.4 merge window submission 2015-11-07 13:33:07 -08:00
hfi1 IB/security: Restrict use of the write() interface 2016-05-04 14:48:48 -07:00
ipath Merge branch 'akpm' (patches from Andrew) 2015-11-07 14:32:45 -08:00
Kconfig staging/rdma: Kconfig change STAGING_RDMA to be tristate. 2015-09-29 03:42:27 +02:00
Makefile IB/ehca: Deprecate driver, move to staging, schedule deletion 2015-09-11 18:13:35 -04:00