1. 03 Jul, 2017 1 commit
    • Boris Pismenny's avatar
      RDMA/uverbs: Check port number supplied by user verbs cmds · 5ecce4c9
      Boris Pismenny authored
      The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
      the port number from user input as part of its attributes and assumes
      it is valid. Down on the stack, that parameter is used to access kernel
      data structures.  If the value is invalid, the kernel accesses memory
      it should not.  To prevent this, verify the port number before using it.
      
      BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
      Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313
      
      BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
      Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819
      
      Fixes: 67cdb40c ("[IB] uverbs: Implement more commands")
      Fixes: 189aba99 ("IB/uverbs: Extend modify_qp and support packet pacing")
      Cc: <stable@vger.kernel.org> # v2.6.14+
      Cc: <security@kernel.org>
      Cc: Yevgeny Kliteynik <kliteyn@mellanox.com>
      Cc: Tziporet Koren <tziporet@mellanox.com>
      Cc: Alex Polak <alexpo@mellanox.com>
      Signed-off-by: default avatarBoris Pismenny <borisp@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      5ecce4c9
  2. 29 Jun, 2017 2 commits
  3. 14 Jun, 2017 14 commits
  4. 13 Jun, 2017 1 commit
  5. 07 Jun, 2017 1 commit
    • Roland Dreier's avatar
      IB/addr: Fix setting source address in addr6_resolve() · 79e25959
      Roland Dreier authored
      Commit eea40b8f ("infiniband: call ipv6 route lookup via the stub
      interface") introduced a regression in address resolution when connecting
      to IPv6 destination addresses.  The old code called ip6_route_output(),
      while the new code calls ipv6_stub->ipv6_dst_lookup().  The two are almost
      the same, except that ipv6_dst_lookup() also calls ip6_route_get_saddr()
      if the source address is in6addr_any.
      
      This means that the test of ipv6_addr_any(&fl6.saddr) now never succeeds,
      and so we never copy the source address out.  This ends up causing
      rdma_resolve_addr() to fail, because without a resolved source address,
      cma_acquire_dev() will fail to find an RDMA device to use.  For me, this
      causes connecting to an NVMe over Fabrics target via RoCE / IPv6 to fail.
      
      Fix this by copying out fl6.saddr if ipv6_addr_any() is true for the original
      source address passed into addr6_resolve().  We can drop our call to
      ipv6_dev_get_saddr() because ipv6_dst_lookup() already does that work.
      
      Fixes: eea40b8f ("infiniband: call ipv6 route lookup via the stub interface")
      Cc: <stable@vger.kernel.org> # 3.12+
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      79e25959
  6. 01 Jun, 2017 21 commits