All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mustafa Ismail <mustafa.ismail@intel.com>
To: linux-rdma@vger.kernel.org
Cc: mustafa.ismail@intel.com, e1000-rdma@lists.sourceforge.net,
	chien.tin.tung@intel.com, shiraz.saleem@intel.com,
	"# v4 . 2-v4 . 9" <stable@vger.kernel.org>,
	security@kernel.org, Doug Ledford <dledford@redhat.com>,
	Steve Wise <swise@opengridcomputing.com>,
	Mike Marciniszyn <mike.marciniszyn@intel.com>
Subject: [PATCH] RDMA/uverbs: Fix the check for port number
Date: Wed, 26 Jul 2017 11:14:46 -0500	[thread overview]
Message-ID: <1501085686-12916-1-git-send-email-mustafa.ismail@intel.com> (raw)

The port number is only valid if IB_QP_PORT is set in the mask.
So only check port number if it is valid to prevent modify_qp
from failing due to an invalid port number.

Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Cc: <stable@vger.kernel.org> # v4.2-v4.9
Cc: <security@kernel.org>
Cc: Doug Ledford <dledford@redhat.com>
Cc: Steve Wise <swise@opengridcomputing.com>
Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>

Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>

Upstream commit 5a7a88f1b488("Fix the check for port number")
Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions.
---
 drivers/infiniband/core/uverbs_cmd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 01e3a37..d118ffe 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2342,8 +2342,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
-	if (cmd.port_num < rdma_start_port(ib_dev) ||
-	    cmd.port_num > rdma_end_port(ib_dev))
+	if ((cmd.attr_mask & IB_QP_PORT) &&
+	    (cmd.port_num < rdma_start_port(ib_dev) ||
+	     cmd.port_num > rdma_end_port(ib_dev)))
 		return -EINVAL;
 
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
-- 
1.8.3.1

             reply	other threads:[~2017-07-26 16:14 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-07-26 16:14 Mustafa Ismail [this message]
     [not found] ` <1501085686-12916-1-git-send-email-mustafa.ismail-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
2017-08-03 22:41   ` [PATCH] RDMA/uverbs: Fix the check for port number Greg KH
2017-08-03 22:41     ` Greg KH
     [not found]     ` <20170803224149.GF2396-U8xfFu+wG4EAvxtiuMwx3w@public.gmane.org>
2017-08-03 23:34       ` Saleem, Shiraz
2017-08-03 23:34         ` Saleem, Shiraz
2017-08-07 11:03   ` Yuval Shaia
2017-08-07 11:03     ` Yuval Shaia
2017-08-07 12:11     ` Chien Tin Tung
2017-08-07 12:11       ` Chien Tin Tung
  -- strict thread matches above, loose matches on Subject: below --
2017-07-26 15:18 Mustafa Ismail
2017-07-26 15:14 Mustafa Ismail

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1501085686-12916-1-git-send-email-mustafa.ismail@intel.com \
    --to=mustafa.ismail@intel.com \
    --cc=chien.tin.tung@intel.com \
    --cc=dledford@redhat.com \
    --cc=e1000-rdma@lists.sourceforge.net \
    --cc=linux-rdma@vger.kernel.org \
    --cc=mike.marciniszyn@intel.com \
    --cc=security@kernel.org \
    --cc=shiraz.saleem@intel.com \
    --cc=stable@vger.kernel.org \
    --cc=swise@opengridcomputing.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.