On 05/18/2016 01:20 PM, Greg KH wrote:
> On Wed, May 18, 2016 at 12:58:38PM -0400, Doug Ledford wrote:
>> From: Jason Gunthorpe <jgunthorpe@xxxxxxxxxxxxxxxxxxxx>
>>
>> The drivers/infiniband stack uses write() as a replacement for
>> bi-directional ioctl(). This is not safe. There are ways to
>> trigger write calls that result in the return structure that
>> is normally written to user space being shunted off to user
>> specified kernel memory instead.
>>
>> For the immediate repair, detect and deny suspicious accesses to
>> the write API.
>>
>> For long term, update the user space libraries and the kernel API
>> to something that doesn't present the same security vulnerabilities
>> (likely a structured ioctl() interface).
>>
>> The impacted uAPI interfaces are generally only available if
>> hardware from drivers/infiniband is installed in the system.
>>
>> Reported-by: Jann Horn <jann@xxxxxxxxx>
>> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
>> Signed-off-by: Jason Gunthorpe <jgunthorpe@xxxxxxxxxxxxxxxxxxxx>
>> [ Expanded check to all known write() entry points ]
>> Cc: stable@xxxxxxxxxxxxxxx # 3.14.x
>> Signed-off-by: Doug Ledford <dledford@xxxxxxxxxx>
>> [ Expanded to include removed ipath driver, and dropped non-existent
>> hfi1 driver ]
>> ---
>> drivers/infiniband/core/ucm.c | 4 ++++
>> drivers/infiniband/core/ucma.c | 3 +++
>> drivers/infiniband/core/uverbs_main.c | 5 +++++
>> drivers/infiniband/hw/ipath/ipath_file_ops.c | 5 +++++
>> drivers/infiniband/hw/qib/qib_file_ops.c | 5 +++++
>> include/rdma/ib.h | 16 ++++++++++++++++
>> 6 files changed, 38 insertions(+)
>
> I don't understand, is this only for 3.14.x?
Yes. You already applied the same patch against 4.5.x, but without the
update to include the ipath driver and with the hfi1 driver still in the
patch.
> If so, what is the git
> commit id in Linus's tree for this?
Sorry, forgot that: e6bd18f57aad
--
Doug Ledford <dledford@xxxxxxxxxx>
GPG KeyID: 0E572FDD
Attachment:
signature.asc
Description: OpenPGP digital signature