Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Jason Gunthorpe c92003c18f IB/security: Restrict use of the write() interface ... commit e6bd18f57a upstream. The drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(). This is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead. For the immediate repair, detect and deny suspicious accesses to the write API. For long term, update the user space libraries and the kernel API to something that doesn't present the same security vulnerabilities (likely a structured ioctl() interface). The impacted uAPI interfaces are generally only available if hardware from drivers/infiniband is installed in the system. Reported-by: Jann Horn <jann@thejh.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> [ Expanded check to all known write() entry points ] Signed-off-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2016-05-04 14:48:48 -07:00
..
cxgb3	iw_cxgb3: Fix incorrectly returning error on success	2016-03-03 15:07:10 -08:00
cxgb4	iw_cxgb4: Remove old FRWR API	2015-10-28 22:32:29 -04:00
mlx4	IB/mlx4: Replace kfree with kvfree in mlx4_ib_destroy_srq	2015-12-22 23:23:34 -05:00
mlx5	IB/mlx5: Expose correct max_sge_rd limit	2016-05-04 14:48:48 -07:00
mthca	Merge branch 'wr-cleanup' into k.o/for-4.4	2015-10-28 22:23:34 -04:00
nes	Initial 4.4 merge window submission	2015-11-07 13:33:07 -08:00
ocrdma	RDMA/ocrdma: Depend on async link events from CNA	2015-12-28 11:45:54 -05:00
qib	IB/security: Restrict use of the write() interface	2016-05-04 14:48:48 -07:00
usnic	usnic: correctly handle kzalloc return value	2015-10-21 16:41:19 -04:00
Makefile	IB/ehca: Deprecate driver, move to staging, schedule deletion	2015-09-11 18:13:35 -04:00