Commit a5880b84 authored Mar 07, 2018 by Leon Romanovsky Committed by Doug Ledford Mar 07, 2018

RDMA/ucma: Check that user doesn't overflow QP state



The QP state is limited and declared in enum ib_qp_state,
but ucma user was able to supply any possible (u32) value.

Reported-by:  <syzbot+0df1ab766f8924b1edba@syzkaller.appspotmail.com>
Fixes: 75216638 ("RDMA/cma: Export rdma cm interface to userspace")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

parent aa0de36a

drivers/infiniband/core/ucma.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1149,6 +1149,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
		if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
		return -EFAULT;

		if (cmd.qp_state > IB_QPS_ERR)
		return -EINVAL;

		ctx = ucma_get_ctx(file, cmd.id);
		if (IS_ERR(ctx))
		return PTR_ERR(ctx);