leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
002bf2282b
linux/drivers/infiniband/hw/mlx5
History
Leon Romanovsky 002bf2282b RDMA/mlx5: Protect from shift operand overflow 
Ensure that user didn't supply values too large that can cause overflow.

UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23
shift exponent -2147483648 is negative
CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call
Trace:
dump_stack+0xde/0x164
ubsan_epilogue+0xe/0x81
set_rq_size+0x7c2/0xa90
create_qp_common+0xc18/0x43c0
mlx5_ib_create_qp+0x379/0x1ca0
create_qp.isra.5+0xc94/0x2260
ib_uverbs_create_qp+0x21b/0x2a0
ib_uverbs_write+0xc2c/0x1010
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
do_syscall_64+0x1aa/0x740
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x433569
RSP: 002b:00007ffc6e62f448 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 0000000000433569
RDX: 0000000000000070 RSI: 00000000200042c0 RDI: 0000000000000003
RBP: 00000000006d5018 R08: 00000000004002f8 R09: 00000000004002f8
R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000
R13: 000000000040c9f0 R14: 000000000040ca80 R15: 0000000000000006

Cc: <stable@vger.kernel.org> # 3.10
Fixes: e126ba97db ("mlx5: Add driver for Mellanox Connect-IB adapters")
Cc: syzkaller <syzkaller@googlegroups.com>
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2018-04-27 11:03:15 -04:00
..
ah.c IB/mlx5: Enable ECN capable bits for UD RoCE v2 QPs 2018-03-27 14:43:10 -06:00
cmd.c net/mlx5: Mkey creation command adjustments 2018-04-05 13:04:49 -06:00
cmd.h IB/mlx5: Device memory support in mlx5_ib 2018-04-05 13:04:49 -06:00
cong.c IB/mlx5: Change debugfs to have per port contents 2018-01-08 11:42:22 -07:00
cq.c mlx5: Move dump error CQE function out of mlx5_ib for code sharing 2018-03-27 17:17:28 -07:00
doorbell.c
gsi.c IB/mlx5: Fix iteration overrun in GSI qps 2016-08-02 14:32:51 -04:00
ib_rep.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-03-23 11:31:58 -04:00
ib_rep.h IB/mlx5: Add proper representors support 2018-02-23 12:36:39 -08:00
ib_virt.c IB/mlx5: Restore IB guid/policy for virtual functions 2017-07-24 10:34:28 -04:00
Kconfig infiniband: mlx5: fix build errors when INFINIBAND_USER_ACCESS=m 2018-04-17 19:26:43 -06:00
mad.c IB/mlx5: Route MADs for dual port RoCE 2018-01-08 11:42:23 -07:00
main.c IB/mlx5: remove duplicate header file 2018-04-16 16:23:02 -06:00
Makefile IB/mlx5: Add basic regiser/unregister representors code 2018-02-23 12:36:39 -08:00
mem.c IB/mlx5: Simplify mlx5_ib_cont_pages 2017-09-25 11:47:24 -04:00
mlx5_ib.h IB/mlx5: Device memory mr registration support 2018-04-05 13:04:49 -06:00
mr.c RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow 2018-04-27 11:03:15 -04:00
odp.c IB/mlx5: Move locks initialization to the corresponding stage 2018-01-03 17:26:59 -07:00
qp.c RDMA/mlx5: Protect from shift operand overflow 2018-04-27 11:03:15 -04:00
srq.c IB/mlx5: Fix integer overflows in mlx5_ib_create_srq 2018-03-13 16:31:21 -04:00