All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] RDMA/uverbs: Fix the check for port number
@ 2017-07-26 15:14 Mustafa Ismail
  0 siblings, 0 replies; 11+ messages in thread
From: Mustafa Ismail @ 2017-07-26 15:14 UTC (permalink / raw)
  To: mustafa.ismail; +Cc: # v4 . 2-v4 . 9, security

The port number is only valid if IB_QP_PORT is set in the mask.
So only check port number if it is valid to prevent modify_qp
from failing due to an invalid port number.

Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Cc: <stable@vger.kernel.org> # v4.2-v4.9
Cc: <security@kernel.org>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>

Upstream commit 5a7a88f1b488("Fix the check for port number")
Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions.
---
 drivers/infiniband/core/uverbs_cmd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 01e3a37..d118ffe 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2342,8 +2342,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
-	if (cmd.port_num < rdma_start_port(ib_dev) ||
-	    cmd.port_num > rdma_end_port(ib_dev))
+	if ((cmd.attr_mask & IB_QP_PORT) &&
+	    (cmd.port_num < rdma_start_port(ib_dev) ||
+	     cmd.port_num > rdma_end_port(ib_dev)))
 		return -EINVAL;
 
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
-- 
1.8.3.1

^ permalink raw reply related	[flat|nested] 11+ messages in thread
* [PATCH] RDMA/uverbs: Fix the check for port number
@ 2017-07-26 15:18 Mustafa Ismail
  0 siblings, 0 replies; 11+ messages in thread
From: Mustafa Ismail @ 2017-07-26 15:18 UTC (permalink / raw)
  To: mustafa.ismail
  Cc: chien.tin.tung, tatyana.e.nikolova, henry.orosco, sindhu.devale,
	# v4 . 2-v4 . 9, security

The port number is only valid if IB_QP_PORT is set in the mask.
So only check port number if it is valid to prevent modify_qp
from failing due to an invalid port number.

Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Cc: <stable@vger.kernel.org> # v4.2-v4.9
Cc: <security@kernel.org>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>

Upstream commit 5a7a88f1b488("Fix the check for port number")
Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions.
---
 drivers/infiniband/core/uverbs_cmd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 01e3a37..d118ffe 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2342,8 +2342,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
-	if (cmd.port_num < rdma_start_port(ib_dev) ||
-	    cmd.port_num > rdma_end_port(ib_dev))
+	if ((cmd.attr_mask & IB_QP_PORT) &&
+	    (cmd.port_num < rdma_start_port(ib_dev) ||
+	     cmd.port_num > rdma_end_port(ib_dev)))
 		return -EINVAL;
 
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
-- 
1.8.3.1

^ permalink raw reply related	[flat|nested] 11+ messages in thread
* [PATCH] RDMA/uverbs: Fix the check for port number
@ 2017-07-26 16:14 Mustafa Ismail
       [not found] ` <1501085686-12916-1-git-send-email-mustafa.ismail-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
  0 siblings, 1 reply; 11+ messages in thread
From: Mustafa Ismail @ 2017-07-26 16:14 UTC (permalink / raw)
  To: linux-rdma
  Cc: mustafa.ismail, e1000-rdma, chien.tin.tung, shiraz.saleem,
	# v4 . 2-v4 . 9, security, Doug Ledford, Steve Wise,
	Mike Marciniszyn

The port number is only valid if IB_QP_PORT is set in the mask.
So only check port number if it is valid to prevent modify_qp
from failing due to an invalid port number.

Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Cc: <stable@vger.kernel.org> # v4.2-v4.9
Cc: <security@kernel.org>
Cc: Doug Ledford <dledford@redhat.com>
Cc: Steve Wise <swise@opengridcomputing.com>
Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>

Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>

Upstream commit 5a7a88f1b488("Fix the check for port number")
Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions.
---
 drivers/infiniband/core/uverbs_cmd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 01e3a37..d118ffe 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2342,8 +2342,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
-	if (cmd.port_num < rdma_start_port(ib_dev) ||
-	    cmd.port_num > rdma_end_port(ib_dev))
+	if ((cmd.attr_mask & IB_QP_PORT) &&
+	    (cmd.port_num < rdma_start_port(ib_dev) ||
+	     cmd.port_num > rdma_end_port(ib_dev)))
 		return -EINVAL;
 
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
-- 
1.8.3.1

^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2017-08-07 12:11 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-07-26 15:14 [PATCH] RDMA/uverbs: Fix the check for port number Mustafa Ismail
2017-07-26 15:18 Mustafa Ismail
2017-07-26 16:14 Mustafa Ismail
     [not found] ` <1501085686-12916-1-git-send-email-mustafa.ismail-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
2017-08-03 22:41   ` Greg KH
2017-08-03 22:41     ` Greg KH
     [not found]     ` <20170803224149.GF2396-U8xfFu+wG4EAvxtiuMwx3w@public.gmane.org>
2017-08-03 23:34       ` Saleem, Shiraz
2017-08-03 23:34         ` Saleem, Shiraz
2017-08-07 11:03   ` Yuval Shaia
2017-08-07 11:03     ` Yuval Shaia
2017-08-07 12:11     ` Chien Tin Tung
2017-08-07 12:11       ` Chien Tin Tung

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.