RDMA/uverbs: Check port number supplied by user verbs cmds
authorBoris Pismenny <borisp@mellanox.com>
Tue, 27 Jun 2017 12:09:13 +0000 (15:09 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 12 Jul 2017 13:01:07 +0000 (15:01 +0200)
commit84b00cd90f4dcd95e64ae6eb7d528deffa0a69cd
tree8843c73707f2ad7034d8523b04b7a67fe2ee2c7f
parent1803bec709f813eef95a0916b6dd9ec265cc757f
RDMA/uverbs: Check port number supplied by user verbs cmds

commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.

The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
the port number from user input as part of its attributes and assumes
it is valid. Down on the stack, that parameter is used to access kernel
data structures.  If the value is invalid, the kernel accesses memory
it should not.  To prevent this, verify the port number before using it.

BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313

BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819

Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Cc: Yevgeny Kliteynik <kliteyn@mellanox.com>
Cc: Tziporet Koren <tziporet@mellanox.com>
Cc: Alex Polak <alexpo@mellanox.com>
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/core/uverbs_cmd.c