leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
84652aefb3
linux/drivers/infiniband/core
History
Roland Dreier 84652aefb3 RDMA/ucma: Introduce safer rdma_addr_size() variants 
There are several places in the ucma ABI where userspace can pass in a
sockaddr but set the address family to AF_IB.  When that happens,
rdma_addr_size() will return a size bigger than sizeof struct sockaddr_in6,
and the ucma kernel code might end up copying past the end of a buffer
not sized for a struct sockaddr_ib.

Fix this by introducing new variants

    int rdma_addr_size_in6(struct sockaddr_in6 *addr);
    int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);

that are type-safe for the types used in the ucma ABI and return 0 if the
size computed is bigger than the size of the type passed in.  We can use
these new variants to check what size userspace has passed in before
copying any addresses.

Reported-by: <syzbot+6800425d54ed3ed8135d@syzkaller.appspotmail.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-28 16:13:36 -06:00
..
addr.c RDMA/ucma: Introduce safer rdma_addr_size() variants 2018-03-28 16:13:36 -06:00
agent.c IB/core: Rename ib_destroy_ah to rdma_destroy_ah 2017-05-01 14:32:43 -04:00
agent.h IB/mad: Add final OPA MAD processing 2015-06-12 14:49:18 -04:00
cache.c {net, IB}/mlx5: Manage port association for multiport RoCE 2018-01-08 11:42:22 -07:00
cgroup.c IB/core: added support to use rdma cgroup controller 2017-01-10 11:14:27 -05:00
cm_msgs.h IB/core: Fix unaligned accesses 2015-05-05 13:21:27 -04:00
cm.c RDMA/cm: Fix access to uninitialized variable 2018-01-28 14:07:16 -07:00
cma_configfs.c IB/cma: use strlcpy() instead of strncpy() 2018-01-15 15:33:21 -07:00
cma.c RDMA/ucma: Fix access to non-initialized CM_ID object 2018-03-14 16:22:55 -04:00
core_priv.h RDMA/restrack: don't use uaccess_kernel() 2018-02-16 10:18:11 -07:00
cq.c RDMA/core: Reduce poll batch for direct cq polling 2018-03-06 20:08:39 -07:00
device.c RDMA/restrack: Move restrack_clean to be symmetrical to restrack_init 2018-03-21 14:22:22 -06:00
fmr_pool.c infiniband: fix core/fmr_pool.c kernel-doc notation 2018-01-10 22:00:34 -07:00
iwcm.c RDMA/netlink: Fix general protection fault 2017-12-07 15:28:07 -05:00
iwcm.h iw_cm: free cm_id resources on the last deref 2016-08-02 13:15:18 -04:00
iwpm_msg.c RDMA/iwpm: Properly mark end of NL messages 2017-09-29 11:32:42 -04:00
iwpm_util.c RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() 2017-12-13 10:55:49 -07:00
iwpm_util.h iwpm: crash fix for large connections test 2016-03-16 13:48:32 -04:00
mad_priv.h IB/mad: use CQ abstraction 2016-01-19 15:25:45 -05:00
mad_rmpp.c IB/mad: Change slid in RMPP recv from 16 to 32 bits 2017-08-08 14:47:18 -04:00
mad_rmpp.h
mad.c drivers: infiniband: remove duplicate includes 2017-12-22 09:39:35 -07:00
Makefile RDMA/restrack: Add general infrastructure to track RDMA resources 2018-01-29 20:21:39 -07:00
mr_pool.c IB/core: add a simple MR pool 2016-05-13 13:37:18 -04:00
multicast.c IB/core: Define 'ib' and 'roce' rdma_ah_attr types 2017-05-01 14:32:43 -04:00
netlink.c RDMA/netlink: Simplify code of autoload modules 2018-01-02 13:36:57 -07:00
nldev.c RDMA/nldev: missing error code in nldev_res_get_doit() 2018-02-01 15:24:32 -07:00
opa_smi.h IB: Add rdma_cap_ib_switch helper and use where appropriate 2015-07-14 13:20:08 -04:00
packer.c IB/core: trivial prink cleanup. 2016-03-03 10:20:25 -05:00
rdma_core.c IB/uverbs: Fix unbalanced unlock on error path for rdma_explicit_destroy 2018-02-15 15:31:26 -07:00
rdma_core.h IB/core: Add new ioctl interface 2017-08-31 08:35:09 -04:00
restrack.c RDMA/restrack: don't use uaccess_kernel() 2018-02-16 10:18:11 -07:00
roce_gid_mgmt.c {net, IB}/mlx5: Manage port association for multiport RoCE 2018-01-08 11:42:22 -07:00
rw.c IB/core: remove redundant check on prot_sg_cnt 2017-10-10 10:49:45 -04:00
sa_query.c IB/core: Fix possible crash to access NULL netdev 2018-03-07 15:15:40 -05:00
sa.h
security.c Merge branch 'from-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git 2017-12-27 21:50:46 -07:00
smi.c IB: Add rdma_cap_ib_switch helper and use where appropriate 2015-07-14 13:20:08 -04:00
smi.h IB: Add rdma_cap_ib_switch helper and use where appropriate 2015-07-14 13:20:08 -04:00
sysfs.c IB/core: Fix two kernel warnings triggered by rxe registration 2018-01-03 17:26:59 -07:00
ucm.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ucma.c RDMA/ucma: Introduce safer rdma_addr_size() variants 2018-03-28 16:13:36 -06:00
ud_header.c IB/core: trivial prink cleanup. 2016-03-03 10:20:25 -05:00
umem_odp.c RDMA/umem: Avoid partial declaration of non-static function 2017-11-10 13:02:12 -05:00
umem.c IB/umem: Fix use of npages/nmap fields 2017-12-18 15:37:06 -07:00
user_mad.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
uverbs_cmd.c RDMA/uverbs: Fix kernel panic while using XRC_TGT QP type 2018-02-21 13:52:19 -05:00
uverbs_ioctl_merge.c IB/uverbs: Fix method merging in uverbs_ioctl_merge 2018-02-15 14:59:45 -07:00
uverbs_ioctl.c IB/uverbs: Fix possible oops with duplicate ioctl attributes 2018-02-15 14:59:46 -07:00
uverbs_main.c RDMA/uverbs: Protect from command mask overflow 2018-02-15 15:31:26 -07:00
uverbs_marshall.c IB/core: Convert OPA AH to IB for Extended LIDs only 2017-11-13 15:53:57 -05:00
uverbs_std_types.c IB/uverbs: Use u64_to_user_ptr() not a union 2018-02-15 14:59:45 -07:00
uverbs.h IB/uverbs: Allow CQ moderation with modify CQ 2017-11-13 16:59:22 -05:00
verbs.c RDMA/restrack: don't use uaccess_kernel() 2018-02-16 10:18:11 -07:00