From: Roland Dreier <roland@xxxxxxxxxxxxxxx> If userspace passes a sockaddr with sa_family == AF_IB to the ucma join IP multicast command, the kernel will memcpy() past the end of the cmd.addr buffer, because sockaddr_ib is bigger than sockaddr_in6. Fix this by returning EINVAL if the addr_size we get back is bigger than the address buffers we're copying between. Reported-and-tested-by: syzbot+6800425d54ed3ed8135d@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Roland Dreier <roland@xxxxxxxxxxxxxxx> --- #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git master drivers/infiniband/core/ucma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index e5a1e7d81326..7684fd54318a 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1427,7 +1427,8 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, join_cmd.uid = cmd.uid; join_cmd.id = cmd.id; join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); - if (!join_cmd.addr_size) + if (!join_cmd.addr_size || + join_cmd.addr_size > min(sizeof(cmd.addr), sizeof(join_cmd.addr))) return -EINVAL; join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER; -- 2.15.1 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
