Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc5c6eed authored by Noa Osherovich's avatar Noa Osherovich Committed by Doug Ledford
Browse files

IB/mlx5: Limit query HCA clock 



When PAGE_SIZE is larger than 4K, the user shouldn't be able to query
the HCA core clock. This counter is within 4KB boundary and the
user-space shall not read information that's after this boundary.

Fixes: b368d7cb ('IB/mlx5: Add hca_core_clock_offset to...')
Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
Signed-off-by: default avatarNoa Osherovich <noaos@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent c0fcebf5

drivers/infiniband/hw/mlx5/main.c

+8 −1
Original line number Diff line number Diff line
@@ -991,7 +991,14 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, 
	if (field_avail(typeof(resp), cqe_version, udata->outlen))

		resp.response_length += sizeof(resp.cqe_version);



	if (field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {

	/*

	 * We don't want to expose information from the PCI bar that is located

	 * after 4096 bytes, so if the arch only supports larger pages, let's

	 * pretend we don't support reading the HCA's core clock. This is also

	 * forced by mmap function.

	 */

	if (PAGE_SIZE <= 4096 &&

	    field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {

		resp.comp_mask |=

			MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET;

		resp.hca_core_clock_offset =