Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e126e3ea authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Greg Kroah-Hartman
Browse files

RDMA/ucma: Limit possible option size 



commit 6a21dfc0d0db7b7e0acedce67ca533a6eb19283c upstream.

Users of ucma are supposed to provide size of option level,
in most paths it is supposed to be equal to u8 or u16, but
it is not the case for the IB path record, where it can be
multiple of struct ib_path_rec_data.

This patch takes simplest possible approach and prevents providing
values more than possible to allocate.

Reported-by: default avatar <syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com>
Fixes: 7ce86409 ("RDMA/ucma: Allow user space to set service type")
Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b6741622

drivers/infiniband/core/ucma.c

+3 −0
Original line number Diff line number Diff line
@@ -1275,6 +1275,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, 
	if (IS_ERR(ctx))

		return PTR_ERR(ctx);



	if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))

		return -EINVAL;



	optval = memdup_user((void __user *) (unsigned long) cmd.optval,

			     cmd.optlen);

	if (IS_ERR(optval)) {