Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754079AbdGMPqK (ORCPT ); Thu, 13 Jul 2017 11:46:10 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:40028 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752045AbdGMPqE (ORCPT ); Thu, 13 Jul 2017 11:46:04 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yevgeny Kliteynik , Tziporet Koren , Alex Polak , Boris Pismenny , Leon Romanovsky , Doug Ledford Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds Date: Thu, 13 Jul 2017 17:42:44 +0200 Message-Id: <20170713153959.566717957@linuxfoundation.org> X-Mailer: git-send-email 2.13.2 In-Reply-To: <20170713153957.515045341@linuxfoundation.org> References: <20170713153957.515045341@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2190 Lines: 61 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Boris Pismenny commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream. The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive the port number from user input as part of its attributes and assumes it is valid. Down on the stack, that parameter is used to access kernel data structures. If the value is invalid, the kernel accesses memory it should not. To prevent this, verify the port number before using it. BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0 Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313 BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0 Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819 Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands") Cc: Yevgeny Kliteynik Cc: Tziporet Koren Cc: Alex Polak Signed-off-by: Boris Pismenny Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman --- Modified from upstream commit: helper function rdma_is_port_valid does not exist in these kernel versions, so use manual comparisons instead. drivers/infiniband/core/uverbs_cmd.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -2287,6 +2287,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; + if (cmd.port_num < rdma_start_port(ib_dev) || + cmd.port_num > rdma_end_port(ib_dev)) + return -EINVAL; + INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd, out_len); @@ -2827,6 +2831,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uv if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; + if (cmd.attr.port_num < rdma_start_port(ib_dev) || + cmd.attr.port_num > rdma_end_port(ib_dev)) + return -EINVAL; + uobj = kmalloc(sizeof *uobj, GFP_KERNEL); if (!uobj) return -ENOMEM;