projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
be85525
)
RDMA/mlx5: Protect from shift operand overflow
author
Leon Romanovsky
<leonro@mellanox.com>
Mon, 23 Apr 2018 14:01:53 +0000
(17:01 +0300)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Wed, 9 May 2018 07:51:52 +0000
(09:51 +0200)
commit
002bf2282b2d7318e444dca9ffcb994afc5d5f15
upstream.
Ensure that user didn't supply values too large that can cause overflow.
UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23
shift exponent -
2147483648
is negative
CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call
Trace:
dump_stack+0xde/0x164
ubsan_epilogue+0xe/0x81
set_rq_size+0x7c2/0xa90
create_qp_common+0xc18/0x43c0
mlx5_ib_create_qp+0x379/0x1ca0
create_qp.isra.5+0xc94/0x2260
ib_uverbs_create_qp+0x21b/0x2a0
ib_uverbs_write+0xc2c/0x1010
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
do_syscall_64+0x1aa/0x740
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x433569
RSP: 002b:
00007ffc6e62f448
EFLAGS:
00000217
ORIG_RAX:
0000000000000001
RAX:
ffffffffffffffda
RBX:
00000000004002f8
RCX:
0000000000433569
RDX:
0000000000000070
RSI:
00000000200042c0
RDI:
0000000000000003
RBP:
00000000006d5018
R08:
00000000004002f8
R09:
00000000004002f8
R10:
00000000004002f8
R11:
0000000000000217
R12:
0000000000000000
R13:
000000000040c9f0
R14:
000000000040ca80
R15:
0000000000000006
Cc: <stable@vger.kernel.org> # 3.10
Fixes:
e126ba97dba9
("mlx5: Add driver for Mellanox Connect-IB adapters")
Cc: syzkaller <syzkaller@googlegroups.com>
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/hw/mlx5/qp.c
patch
|
blob
|
history
diff --git
a/drivers/infiniband/hw/mlx5/qp.c
b/drivers/infiniband/hw/mlx5/qp.c
index
464c78f
..
c487867
100644
(file)
--- a/
drivers/infiniband/hw/mlx5/qp.c
+++ b/
drivers/infiniband/hw/mlx5/qp.c
@@
-256,7
+256,11
@@
static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
} else {
if (ucmd) {
qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+ if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
+ return -EINVAL;
qp->rq.wqe_shift = ucmd->rq_wqe_shift;
+ if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig)
+ return -EINVAL;
qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
qp->rq.max_post = qp->rq.wqe_cnt;
} else {