mirror of
https://github.com/torvalds/linux.git
synced 2024-11-28 15:11:31 +00:00
9d194d1025
In case of error while accessing to userspace memory, function
nes_create_qp() returns NULL instead of an error code wrapped through
ERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it
check for error with IS_ERR().
As page 0 is likely not mapped, it is going to trigger an Oops when
the kernel will try to dereference NULL pointer to access to struct
ib_qp's fields.
In some rare cases, page 0 could be mapped by userspace, which could
turn this bug to a vulnerability that could be exploited: the function
pointers in struct ib_device will be under userspace total control.
This was caught when using spatch (aka. coccinelle)
to rewrite calls to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null
Link:
|
||
|---|---|---|
| .. | ||
| amso1100 | ||
| cxgb3 | ||
| cxgb4 | ||
| ehca | ||
| ipath | ||
| mlx4 | ||
| mlx5 | ||
| mthca | ||
| nes | ||
| ocrdma | ||
| qib | ||
| usnic | ||