diff options
| author | Roland Dreier <roland@purestorage.com> | 2018-03-28 11:27:22 -0700 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@microsoft.com> | 2018-05-22 21:33:56 -0400 |
| commit | 6dd7151f6115b36ce880d2ab1bd6d7017bd5217b (patch) | |
| tree | 1c576ee90a2d5543c1a86e56e6330af7c9ba0639 /include | |
| parent | e4cb8e591ae97bf7524f89d342a1932d31bfd6d1 (diff) | |
RDMA/ucma: Introduce safer rdma_addr_size() variants
[ Upstream commit 84652aefb347297aa08e91e283adf7b18f77c2d5 ]
There are several places in the ucma ABI where userspace can pass in a
sockaddr but set the address family to AF_IB. When that happens,
rdma_addr_size() will return a size bigger than sizeof struct sockaddr_in6,
and the ucma kernel code might end up copying past the end of a buffer
not sized for a struct sockaddr_ib.
Fix this by introducing new variants
int rdma_addr_size_in6(struct sockaddr_in6 *addr);
int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);
that are type-safe for the types used in the ucma ABI and return 0 if the
size computed is bigger than the size of the type passed in. We can use
these new variants to check what size userspace has passed in before
copying any addresses.
Reported-by: <syzbot+6800425d54ed3ed8135d@syzkaller.appspotmail.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/rdma/ib_addr.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h index e6796dc8c764..561b0ca8cb19 100644 --- a/include/rdma/ib_addr.h +++ b/include/rdma/ib_addr.h @@ -109,6 +109,8 @@ int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev, const unsigned char *dst_dev_addr); int rdma_addr_size(struct sockaddr *addr); +int rdma_addr_size_in6(struct sockaddr_in6 *addr); +int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr); int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id); int rdma_addr_find_dmac_by_grh(union ib_gid *sgid, union ib_gid *dgid, u8 *smac, |