| From de1d1b0b537c0adeefb0fc1d5abfb13f599eed55 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Fri, 11 Oct 2019 16:34:19 +0300 |
| Subject: [PATCH] RDMA/uverbs: Prevent potential underflow |
| |
| commit a9018adfde809d44e71189b984fa61cc89682b5e upstream. |
| |
| The issue is in drivers/infiniband/core/uverbs_std_types_cq.c in the |
| UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE) function. We check that: |
| |
| if (attr.comp_vector >= attrs->ufile->device->num_comp_vectors) { |
| |
| But we don't check if "attr.comp_vector" is negative. It could |
| potentially lead to an array underflow. My concern would be where |
| cq->vector is used in the create_cq() function from the cxgb4 driver. |
| |
| And really "attr.comp_vector" is appears as a u32 to user space so that's |
| the right type to use. |
| |
| Fixes: 9ee79fce3642 ("IB/core: Add completion queue (cq) object actions") |
| Link: https://lore.kernel.org/r/20191011133419.GA22905@mwanda |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Reviewed-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h |
| index 1e5aeb39f774..63f7f7db5902 100644 |
| --- a/drivers/infiniband/core/uverbs.h |
| +++ b/drivers/infiniband/core/uverbs.h |
| @@ -98,7 +98,7 @@ ib_uverbs_init_udata_buf_or_null(struct ib_udata *udata, |
| |
| struct ib_uverbs_device { |
| atomic_t refcount; |
| - int num_comp_vectors; |
| + u32 num_comp_vectors; |
| struct completion comp; |
| struct device dev; |
| /* First group for device attributes, NULL terminated array */ |
| diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h |
| index db0fc59cf4f0..4a9fdc4e2d73 100644 |
| --- a/include/rdma/ib_verbs.h |
| +++ b/include/rdma/ib_verbs.h |
| @@ -346,7 +346,7 @@ struct ib_tm_caps { |
| |
| struct ib_cq_init_attr { |
| unsigned int cqe; |
| - int comp_vector; |
| + u32 comp_vector; |
| u32 flags; |
| }; |
| |
| -- |
| 2.7.4 |
| |