This is a note to let you know that I've just added the patch titled
RDMA/uverbs: Check port number supplied by user verbs cmds
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rdma-uverbs-check-port-number-supplied-by-user-verbs-cmds.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5ecce4c9b17bed4dc9cb58bfb10447307569b77b Mon Sep 17 00:00:00 2001
From: Boris Pismenny <borisp@xxxxxxxxxxxx>
Date: Tue, 27 Jun 2017 15:09:13 +0300
Subject: RDMA/uverbs: Check port number supplied by user verbs cmds
From: Boris Pismenny <borisp@xxxxxxxxxxxx>
commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.
The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
the port number from user input as part of its attributes and assumes
it is valid. Down on the stack, that parameter is used to access kernel
data structures. If the value is invalid, the kernel accesses memory
it should not. To prevent this, verify the port number before using it.
BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313
BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819
Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Cc: Yevgeny Kliteynik <kliteyn@xxxxxxxxxxxx>
Cc: Tziporet Koren <tziporet@xxxxxxxxxxxx>
Cc: Alex Polak <alexpo@xxxxxxxxxxxx>
Signed-off-by: Boris Pismenny <borisp@xxxxxxxxxxxx>
Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
Signed-off-by: Doug Ledford <dledford@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions, so use manual comparisons instead.
drivers/infiniband/core/uverbs_cmd.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2342,6 +2342,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv
if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT;
+ if (cmd.port_num < rdma_start_port(ib_dev) ||
+ cmd.port_num > rdma_end_port(ib_dev))
+ return -EINVAL;
+
INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
out_len);
@@ -2882,6 +2886,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uv
if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT;
+ if (cmd.attr.port_num < rdma_start_port(ib_dev) ||
+ cmd.attr.port_num > rdma_end_port(ib_dev))
+ return -EINVAL;
+
uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
if (!uobj)
return -ENOMEM;
Patches currently in stable-queue which might be from borisp@xxxxxxxxxxxx are
queue-4.9/rdma-uverbs-check-port-number-supplied-by-user-verbs-cmds.patch