From: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> To: Nicolas Palix <Nicolas.Palix-MZpvjPyXg2s@public.gmane.org> Cc: Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>, Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>, Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>, Hal Rosenstock <hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>, linux-rdma <linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, kernel-janitors <kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> Subject: [patch v2] infiniband: uverbs: limit the number of entries Date: Fri, 8 Oct 2010 16:25:58 +0200 [thread overview] Message-ID: <20101008142557.GP11681@bicker> (raw) In-Reply-To: <AANLkTin5zou2JHsdDyhGESuxyPonOs3kLo9Th0vg-kd8-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> If we don't limit cmd.ne then the multiplications can overflow. This will allocate a small amount of RAM successfully for the "resp" and "wc" buffers. The heap will get corrupted when we call ib_poll_cq(). Documentation/infiniband/user_verbs.txt suggests this function is meant for unprivileged access. I chose to limit the number of entries to 500. That limits the allocations to 26 kb of RAM at the most. Also we don't necessarily fill the "resp" buffer so I changed the kmalloc() to a kzalloc() to avoid an information leak. And I changed the wc allocation to kcalloc() as a cleanup. CC: stable-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h --- a/drivers/infiniband/core/uverbs.h +++ b/drivers/infiniband/core/uverbs.h @@ -162,6 +162,7 @@ void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr); void ib_uverbs_event_handler(struct ib_event_handler *handler, struct ib_event *event); +#define UVERBS_MAX_NUM_ENTRIES 500 #define IB_UVERBS_DECLARE_CMD(name) \ ssize_t ib_uverbs_##name(struct ib_uverbs_file *file, \ const char __user *buf, int in_len, \ diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -906,12 +906,15 @@ ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file, if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; + if (cmd.ne > UVERBS_MAX_NUM_ENTRIES) + cmd.ne = UVERBS_MAX_NUM_ENTRIES; + - wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL); + wc = kcalloc(cmd.ne, sizeof *wc, GFP_KERNEL); if (!wc) return -ENOMEM; rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc); - resp = kmalloc(rsize, GFP_KERNEL); + resp = kzalloc(rsize, GFP_KERNEL); if (!resp) { ret = -ENOMEM; goto out_wc; -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com> To: Nicolas Palix <Nicolas.Palix-MZpvjPyXg2s@public.gmane.org> Cc: Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>, Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>, Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>, Hal Rosenstock <hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>, linux-rdma <linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>, kernel-janitors <kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> Subject: [patch v2] infiniband: uverbs: limit the number of entries Date: Fri, 08 Oct 2010 14:25:58 +0000 [thread overview] Message-ID: <20101008142557.GP11681@bicker> (raw) In-Reply-To: <AANLkTin5zou2JHsdDyhGESuxyPonOs3kLo9Th0vg-kd8-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> If we don't limit cmd.ne then the multiplications can overflow. This will allocate a small amount of RAM successfully for the "resp" and "wc" buffers. The heap will get corrupted when we call ib_poll_cq(). Documentation/infiniband/user_verbs.txt suggests this function is meant for unprivileged access. I chose to limit the number of entries to 500. That limits the allocations to 26 kb of RAM at the most. Also we don't necessarily fill the "resp" buffer so I changed the kmalloc() to a kzalloc() to avoid an information leak. And I changed the wc allocation to kcalloc() as a cleanup. CC: stable@kernel.org Signed-off-by: Dan Carpenter <error27@gmail.com> diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h --- a/drivers/infiniband/core/uverbs.h +++ b/drivers/infiniband/core/uverbs.h @@ -162,6 +162,7 @@ void ib_uverbs_srq_event_handler(struct ib_event *event, void *context_ptr); void ib_uverbs_event_handler(struct ib_event_handler *handler, struct ib_event *event); +#define UVERBS_MAX_NUM_ENTRIES 500 #define IB_UVERBS_DECLARE_CMD(name) \ ssize_t ib_uverbs_##name(struct ib_uverbs_file *file, \ const char __user *buf, int in_len, \ diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -906,12 +906,15 @@ ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file, if (copy_from_user(&cmd, buf, sizeof cmd)) return -EFAULT; + if (cmd.ne > UVERBS_MAX_NUM_ENTRIES) + cmd.ne = UVERBS_MAX_NUM_ENTRIES; + - wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL); + wc = kcalloc(cmd.ne, sizeof *wc, GFP_KERNEL); if (!wc) return -ENOMEM; rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc); - resp = kmalloc(rsize, GFP_KERNEL); + resp = kzalloc(rsize, GFP_KERNEL); if (!resp) { ret = -ENOMEM; goto out_wc;
next prev parent reply other threads:[~2010-10-08 14:25 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2010-10-07 7:16 [patch] infiniband: uverbs: limit the number of entries Dan Carpenter 2010-10-07 7:16 ` Dan Carpenter 2010-10-07 16:16 ` Jason Gunthorpe 2010-10-07 16:16 ` Jason Gunthorpe [not found] ` <20101007161649.GD21206-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-10-07 16:59 ` Dan Carpenter 2010-10-07 16:59 ` Dan Carpenter 2010-10-08 7:59 ` Nicolas Palix 2010-10-08 7:59 ` Nicolas Palix [not found] ` <AANLkTin5zou2JHsdDyhGESuxyPonOs3kLo9Th0vg-kd8-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2010-10-08 14:25 ` Dan Carpenter [this message] 2010-10-08 14:25 ` [patch v2] " Dan Carpenter 2010-10-09 23:16 ` [patch] " Jason Gunthorpe 2010-10-09 23:16 ` Jason Gunthorpe [not found] ` <20101009231607.GA24649-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-10-12 11:31 ` [patch v3] infiniband: uverbs: handle large " Dan Carpenter 2010-10-12 11:31 ` Dan Carpenter 2010-10-12 21:01 ` Jason Gunthorpe 2010-10-12 21:01 ` Jason Gunthorpe [not found] ` <20101012210118.GR24268-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-10-13 9:05 ` Dan Carpenter 2010-10-13 9:05 ` Dan Carpenter 2010-10-13 9:13 ` [patch v4] " Dan Carpenter 2010-10-13 9:13 ` Dan Carpenter 2010-11-23 7:10 ` Dan Carpenter 2010-11-23 7:10 ` Dan Carpenter 2010-11-24 22:07 ` Roland Dreier 2010-11-24 22:07 ` Roland Dreier [not found] ` <adahbf6gytv.fsf-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org> 2010-11-24 22:18 ` Jason Gunthorpe 2010-11-24 22:18 ` Jason Gunthorpe [not found] ` <20101124221845.GH2369-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-11-25 4:05 ` Roland Dreier 2010-11-25 4:05 ` Roland Dreier [not found] ` <adad3pugi90.fsf-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org> 2010-11-25 4:13 ` Jason Gunthorpe 2010-11-25 4:13 ` Jason Gunthorpe [not found] ` <20101125041337.GA11049-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-11-25 15:00 ` ibv_post_send/recv kernel path optimizations (was: uverbs: handle large number of entries) Or Gerlitz [not found] ` <4CEE7A22.2040706-smomgflXvOZWk0Htik3J/w@public.gmane.org> 2010-11-26 11:56 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C644860408064B44854-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2010-12-01 8:11 ` ibv_post_send/recv kernel path optimizations Or Gerlitz [not found] ` <4CF60343.7050602-smomgflXvOZWk0Htik3J/w@public.gmane.org> 2010-12-08 12:14 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C64486040806673CF38-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2010-12-08 18:30 ` Jason Gunthorpe 2010-12-08 19:04 ` Roland Dreier 2010-12-14 14:12 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C644860408066ABCF66-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2010-12-14 18:17 ` Jason Gunthorpe [not found] ` <20101214181735.GA2506-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 2010-12-27 12:38 ` Or Gerlitz [not found] ` <4D1888CB.2010101-hKgKHo2Ms0FWk0Htik3J/w@public.gmane.org> 2010-12-27 15:18 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C644860408066C547E0-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2010-12-27 15:22 ` Or Gerlitz [not found] ` <4D18AF2D.1010109-smomgflXvOZWk0Htik3J/w@public.gmane.org> 2010-12-27 15:40 ` Walukiewicz, Miroslaw 2011-01-05 18:16 ` Roland Dreier [not found] ` <ada4o9nfc6e.fsf-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org> 2011-01-10 14:15 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C644860408066DDDF31-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2011-01-10 20:38 ` Roland Dreier [not found] ` <adawrmc7av2.fsf-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org> 2011-01-21 11:41 ` Walukiewicz, Miroslaw [not found] ` <BE2BFE91933D1B4089447C644860408066F95285-IGOiFh9zz4wLt2AQoY/u9bfspsVTdybXVpNB7YpNyf8@public.gmane.org> 2011-01-21 15:49 ` Hefty, Sean [not found] ` <CF9C39F99A89134C9CF9C4CCB68B8DDF25C1D51C31-osO9UTpF0USkrb+BlOpmy7fspsVTdybXVpNB7YpNyf8@public.gmane.org> 2011-01-24 17:03 ` Walukiewicz, Miroslaw
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20101008142557.GP11681@bicker \ --to=error27-re5jqeeqqe8avxtiumwx3w@public.gmane.org \ --cc=Nicolas.Palix-MZpvjPyXg2s@public.gmane.org \ --cc=hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \ --cc=jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org \ --cc=kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org \ --cc=sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.