• Boris Pismenny's avatar
    RDMA/uverbs: Check port number supplied by user verbs cmds · 29f0189e
    Boris Pismenny authored
    commit 5ecce4c9 upstream.
    
    The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
    the port number from user input as part of its attributes and assumes
    it is valid. Down on the stack, that parameter is used to access kernel
    data structures.  If the value is invalid, the kernel accesses memory
    it should not.  To prevent this, verify the port number before using it.
    
    BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
    Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313
    
    BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
    Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819
    
    Fixes: 67cdb40c ("[IB] uverbs: Implement more commands")
    Fixes: 189aba99 ("IB/uverbs: Extend modify_qp and support packet pacing")
    Cc: Yevgeny Kliteynik <kliteyn@mellanox.com>
    Cc: Tziporet Koren <tziporet@mellanox.com>
    Cc: Alex Polak <alexpo@mellanox.com>
    Signed-off-by: default avatarBoris Pismenny <borisp@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    29f0189e
uverbs_cmd.c 109 KB