Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6bd18f5 authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Doug Ledford
Browse files

IB/security: Restrict use of the write() interface 



The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: default avatarJann Horn <jann@thejh.net>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarJason Gunthorpe <jgunthorpe@obsidianresearch.com>
[ Expanded check to all known write() entry points ]
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 7723d8c2

drivers/infiniband/core/ucm.c

+4 −0
Original line number Diff line number Diff line
@@ -48,6 +48,7 @@ 


#include <asm/uaccess.h>



#include <rdma/ib.h>

#include <rdma/ib_cm.h>

#include <rdma/ib_user_cm.h>

#include <rdma/ib_marshall.h>
@@ -1103,6 +1104,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, 
	struct ib_ucm_cmd_hdr hdr;

	ssize_t result;



	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))

		return -EACCES;



	if (len < sizeof(hdr))

		return -EINVAL;

drivers/infiniband/core/ucma.c

+3 −0
Original line number Diff line number Diff line
@@ -1574,6 +1574,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, 
	struct rdma_ucm_cmd_hdr hdr;

	ssize_t ret;



	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))

		return -EACCES;



	if (len < sizeof(hdr))

		return -EINVAL;

drivers/infiniband/core/uverbs_main.c

+5 −0
Original line number Diff line number Diff line
@@ -48,6 +48,8 @@ 


#include <asm/uaccess.h>



#include <rdma/ib.h>



#include "uverbs.h"



MODULE_AUTHOR("Roland Dreier");
@@ -709,6 +711,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, 
	int srcu_key;

	ssize_t ret;



	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))

		return -EACCES;



	if (count < sizeof hdr)

		return -EINVAL;

drivers/infiniband/hw/qib/qib_file_ops.c

+5 −0
Original line number Diff line number Diff line
@@ -45,6 +45,8 @@ 
#include <linux/export.h>

#include <linux/uio.h>



#include <rdma/ib.h>



#include "qib.h"

#include "qib_common.h"

#include "qib_user_sdma.h"
@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data, 
	ssize_t ret = 0;

	void *dest;



	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))

		return -EACCES;



	if (count < sizeof(cmd.type)) {

		ret = -EINVAL;

		goto bail;

drivers/staging/rdma/hfi1/TODO

+1 −1
Original line number Diff line number Diff line
@@ -3,4 +3,4 @@ July, 2015 
- Remove unneeded file entries in sysfs

- Remove software processing of IB protocol and place in library for use

  by qib, ipath (if still present), hfi1, and eventually soft-roce

- Replace incorrect uAPI