lkml.org 
[lkml]   [2018]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 23/43] RDMA/mlx5: Protect from shift operand overflow
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Leon Romanovsky <leonro@mellanox.com>

    commit 002bf2282b2d7318e444dca9ffcb994afc5d5f15 upstream.

    Ensure that user didn't supply values too large that can cause overflow.

    UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23
    shift exponent -2147483648 is negative
    CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call
    Trace:
    dump_stack+0xde/0x164
    ubsan_epilogue+0xe/0x81
    set_rq_size+0x7c2/0xa90
    create_qp_common+0xc18/0x43c0
    mlx5_ib_create_qp+0x379/0x1ca0
    create_qp.isra.5+0xc94/0x2260
    ib_uverbs_create_qp+0x21b/0x2a0
    ib_uverbs_write+0xc2c/0x1010
    vfs_write+0x1b0/0x550
    SyS_write+0xc7/0x1a0
    do_syscall_64+0x1aa/0x740
    entry_SYSCALL_64_after_hwframe+0x26/0x9b
    RIP: 0033:0x433569
    RSP: 002b:00007ffc6e62f448 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 0000000000433569
    RDX: 0000000000000070 RSI: 00000000200042c0 RDI: 0000000000000003
    RBP: 00000000006d5018 R08: 00000000004002f8 R09: 00000000004002f8
    R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000
    R13: 000000000040c9f0 R14: 000000000040ca80 R15: 0000000000000006

    Cc: <stable@vger.kernel.org> # 3.10
    Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
    Cc: syzkaller <syzkaller@googlegroups.com>
    Reported-by: Noa Osherovich <noaos@mellanox.com>
    Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/infiniband/hw/mlx5/qp.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/drivers/infiniband/hw/mlx5/qp.c
    +++ b/drivers/infiniband/hw/mlx5/qp.c
    @@ -256,7 +256,11 @@ static int set_rq_size(struct mlx5_ib_de
    } else {
    if (ucmd) {
    qp->rq.wqe_cnt = ucmd->rq_wqe_count;
    + if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
    + return -EINVAL;
    qp->rq.wqe_shift = ucmd->rq_wqe_shift;
    + if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig)
    + return -EINVAL;
    qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig;
    qp->rq.max_post = qp->rq.wqe_cnt;
    } else {

    \
     
     \ /
      Last update: 2018-05-08 10:16    [W:3.435 / U:0.500 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site