From: Di Zhu <zhudi21@xxxxxxxxxx>
Notice that i40iw_mmap() is used as mmap for file
/dev/infiniband/uverbs%d and these files have access mode
with 0666 specified by uverbs_devnode() and vma->vm_pgoff
is directly used to calculate pfn which is passed in
remap_pfn_range function without any valid validation.
This would result in a malicious process being able to pass an arbitrary
physical address to ‘mmap’ which would allow for access to all of
kernel memory from user space and eventually gain root privileges.
So, we should check whether final calculated value of vm_pgoff is
in range of specified pci resource before we use it to calculate
pfn which is passed in remap_pfn_range
Signed-off-by: Di Zhu <zhudi21@xxxxxxxxxx>
---
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 5ad381800f4d..7ec8f221eadb 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -185,6 +185,10 @@ static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
+ if (vma->vm_pgoff >
+ pci_resource_len(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT)
+ return -EINVAL;
+
if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
} else {
--
2.23.0
