Boris Pismenny 5ecce4c9b1 RDMA/uverbs: Check port number supplied by user verbs cmds ... The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive the port number from user input as part of its attributes and assumes it is valid. Down on the stack, that parameter is used to access kernel data structures. If the value is invalid, the kernel accesses memory it should not. To prevent this, verify the port number before using it. BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0 Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313 BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0 Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819 Fixes: 67cdb40ca4 ("[IB] uverbs: Implement more commands") Fixes: 189aba99e7 ("IB/uverbs: Extend modify_qp and support packet pacing") Cc: <stable@vger.kernel.org> # v2.6.14+ Cc: <security@kernel.org> Cc: Yevgeny Kliteynik <kliteyn@mellanox.com> Cc: Tziporet Koren <tziporet@mellanox.com> Cc: Alex Polak <alexpo@mellanox.com> Signed-off-by: Boris Pismenny <borisp@mellanox.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com>		2017-07-03 11:06:55 -04:00
..
core	RDMA/uverbs: Check port number supplied by user verbs cmds	2017-07-03 11:06:55 -04:00
hw	rdma/cxgb4: Fix memory leaks during module exit	2017-06-14 15:24:50 -04:00
sw	rxe: Fix a sleep-in-atomic bug in post_one_send	2017-06-14 13:02:01 -04:00
ulp	IB/opa_vnic: Use spinlock instead of mutex for stats_lock	2017-06-29 12:43:52 -04:00
Kconfig	IB/opa-vnic: Virtual Network Interface Controller (VNIC) netdev	2017-04-20 12:01:38 -04:00
Makefile	IB/rdmavt: Create module framework and handle driver registration	2016-03-10 20:37:04 -05:00