| From: Roland Dreier <roland@purestorage.com> |
| Date: Tue, 3 Apr 2018 15:33:01 -0700 |
| Subject: RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA |
| device |
| |
| commit 8435168d50e66fa5eae01852769d20a36f9e5e83 upstream. |
| |
| Check to make sure that ctx->cm_id->device is set before we use it. |
| Otherwise userspace can trigger a NULL dereference by doing |
| RDMA_USER_CM_CMD_SET_OPTION on an ID that is not bound to a device. |
| |
| Reported-by: <syzbot+a67bc93e14682d92fc2f@syzkaller.appspotmail.com> |
| Signed-off-by: Roland Dreier <roland@purestorage.com> |
| Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/infiniband/core/ucma.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/infiniband/core/ucma.c |
| +++ b/drivers/infiniband/core/ucma.c |
| @@ -1142,6 +1142,9 @@ static int ucma_set_ib_path(struct ucma_ |
| if (!optlen) |
| return -EINVAL; |
| |
| + if (!ctx->cm_id->device) |
| + return -EINVAL; |
| + |
| memset(&sa_path, 0, sizeof(sa_path)); |
| sa_path.vlan_id = 0xffff; |
| |
