Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Boris Pismenny 84b00cd90f RDMA/uverbs: Check port number supplied by user verbs cmds ... commit 5ecce4c9b1 upstream. The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive the port number from user input as part of its attributes and assumes it is valid. Down on the stack, that parameter is used to access kernel data structures. If the value is invalid, the kernel accesses memory it should not. To prevent this, verify the port number before using it. BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0 Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313 BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0 Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819 Fixes: 67cdb40ca4 ("[IB] uverbs: Implement more commands") Cc: Yevgeny Kliteynik <kliteyn@mellanox.com> Cc: Tziporet Koren <tziporet@mellanox.com> Cc: Alex Polak <alexpo@mellanox.com> Signed-off-by: Boris Pismenny <borisp@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2017-07-12 15:01:07 +02:00
..
core	RDMA/uverbs: Check port number supplied by user verbs cmds	2017-07-12 15:01:07 +02:00
hw	infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data	2017-07-05 14:40:30 +02:00
sw	IB/rxe: Fix mem_check_range integer overflow	2017-02-14 15:25:42 -08:00
ulp	IB/IPoIB: ibX: failed to create mcg debug file	2017-05-20 14:28:38 +02:00
Kconfig	qedr: Add RoCE driver framework	2016-10-14 15:00:10 -04:00
Makefile	IB/rdmavt: Create module framework and handle driver registration	2016-03-10 20:37:04 -05:00