| From 8435168d50e66fa5eae01852769d20a36f9e5e83 Mon Sep 17 00:00:00 2001 |
| From: Roland Dreier <roland@purestorage.com> |
| Date: Tue, 3 Apr 2018 15:33:01 -0700 |
| Subject: RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device |
| |
| From: Roland Dreier <roland@purestorage.com> |
| |
| commit 8435168d50e66fa5eae01852769d20a36f9e5e83 upstream. |
| |
| Check to make sure that ctx->cm_id->device is set before we use it. |
| Otherwise userspace can trigger a NULL dereference by doing |
| RDMA_USER_CM_CMD_SET_OPTION on an ID that is not bound to a device. |
| |
| Cc: <stable@vger.kernel.org> |
| Reported-by: <syzbot+a67bc93e14682d92fc2f@syzkaller.appspotmail.com> |
| Signed-off-by: Roland Dreier <roland@purestorage.com> |
| Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/infiniband/core/ucma.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/infiniband/core/ucma.c |
| +++ b/drivers/infiniband/core/ucma.c |
| @@ -1231,6 +1231,9 @@ static int ucma_set_ib_path(struct ucma_ |
| if (!optlen) |
| return -EINVAL; |
| |
| + if (!ctx->cm_id->device) |
| + return -EINVAL; |
| + |
| memset(&sa_path, 0, sizeof(sa_path)); |
| |
| ib_sa_unpack_path(path_data->path_rec, &sa_path); |
