From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754480AbdJIM6T (ORCPT ); Mon, 9 Oct 2017 08:58:19 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:41943 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754399AbdJIMpW (ORCPT ); Mon, 9 Oct 2017 08:45:22 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Leon Romanovsky" , "Tziporet Koren" , "Boris Pismenny" , "Doug Ledford" , "Alex Polak" , "Yevgeny Kliteynik" , "" Date: Mon, 09 Oct 2017 13:30:34 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 33/74] RDMA/uverbs: Check port number supplied by user verbs cmds In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.94-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Boris Pismenny commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream. The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive the port number from user input as part of its attributes and assumes it is valid. Down on the stack, that parameter is used to access kernel data structures. If the value is invalid, the kernel accesses memory it should not. To prevent this, verify the port number before using it. BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0 Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313 BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0 Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819 Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands") Fixes: 189aba99e70 ("IB/uverbs: Extend modify_qp and support packet pacing") Cc: Cc: Yevgeny Kliteynik Cc: Tziporet Koren Cc: Alex Polak Signed-off-by: Boris Pismenny Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford [bwh: Backported to 3.2: - In modify_qp(), command structure is cmd not cmd->base - In modify_qp(), add release_qp label - In ib_uverbs_create_ah(), add definition of ib_dev - Adjust context] Signed-off-by: Ben Hutchings --- drivers/infiniband/core/uverbs_cmd.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -1790,6 +1790,11 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv goto out; } + if (!rdma_is_port_valid(qp->device, cmd.port_num)) { + ret = -EINVAL; + goto release_qp; + } + attr->qp_state = cmd.qp_state; attr->cur_qp_state = cmd.cur_qp_state; attr->path_mtu = cmd.path_mtu; @@ -1843,6 +1848,7 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv ret = ib_modify_qp(qp, attr, modify_qp_mask(qp->qp_type, cmd.attr_mask)); } +release_qp: put_qp_read(qp); if (ret) @@ -2262,6 +2268,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uv const char __user *buf, int in_len, int out_len) { + struct ib_device *ib_dev = file->device->ib_dev; struct ib_uverbs_create_ah cmd; struct ib_uverbs_create_ah_resp resp; struct ib_uobject *uobj; @@ -2276,6 +2283,9 @@ ssize_t ib_uverbs_create_ah(struct ib_uv if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; + if (!rdma_is_port_valid(ib_dev, cmd.attr.port_num)) + return -EINVAL; + uobj = kmalloc(sizeof *uobj, GFP_KERNEL); if (!uobj) return -ENOMEM;