All of lore.kernel.org
 help / color / mirror / Atom feed
From: Bob Pearson <rpearsonhpe@gmail.com>
To: linux-rdma@vger.kernel.org
Cc: Bob Pearson <rpearson@hpe.com>
Subject: [PATCH 14/20] Addresses an issue with hardened user copy
Date: Fri, 14 Aug 2020 23:58:38 -0500	[thread overview]
Message-ID: <20200815045912.8626-15-rpearson@hpe.com> (raw)
In-Reply-To: <20200815045912.8626-1-rpearson@hpe.com>

Copying to user space from the stack instead of slab cache cured
a kernel oops that was toubling me.A

Signed-off-by: Bob Pearson <rpearson@hpe.com>
---
 drivers/infiniband/core/uverbs_std_types_qp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_std_types_qp.c b/drivers/infiniband/core/uverbs_std_types_qp.c
index 3bf8dcdfe7eb..2f8b14003b95 100644
--- a/drivers/infiniband/core/uverbs_std_types_qp.c
+++ b/drivers/infiniband/core/uverbs_std_types_qp.c
@@ -98,6 +98,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
 	struct ib_device *device;
 	u64 user_handle;
 	int ret;
+	int qp_num;
 
 	ret = uverbs_copy_from_or_zero(&cap, attrs,
 			       UVERBS_ATTR_CREATE_QP_CAP);
@@ -293,9 +294,10 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
 	if (ret)
 		return ret;
 
+	/* copy from stack to avoid whitelisting issues */
+	qp_num = qp->qp_num;
 	ret = uverbs_copy_to(attrs, UVERBS_ATTR_CREATE_QP_RESP_QP_NUM,
-			     &qp->qp_num,
-			     sizeof(qp->qp_num));
+			     &qp_num, sizeof(qp_num));
 
 	return ret;
 err_put:
-- 
2.25.1


  parent reply	other threads:[~2020-08-15 21:51 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-15  4:58 Memory windows support for rxe Bob Pearson
2020-08-15  4:58 ` [PATCH 01/20] Added ib_uverbs_wc_opcode to ib_user_verbs.h Bob Pearson
2020-08-15  4:58 ` [PATCH 02/20] Added missing IB_WR_BIND_MW opcode Bob Pearson
2020-08-15  4:58 ` [PATCH 03/20] Added bind_mw parameters to rxe_send_wr Bob Pearson
2020-08-15  4:58 ` [PATCH 04/20] Added stubs for alloc_mw and dealloc_mw verbs Bob Pearson
2020-08-15  4:58 ` [PATCH 05/20] Separated MR and MW objects Bob Pearson
2020-08-15  4:58 ` [PATCH 06/20] Added a basic rxe_mw struct Bob Pearson
2020-08-15  4:58 ` [PATCH 07/20] Implemented functional alloc_mw and dealloc_mw APIs Bob Pearson
2020-08-15  4:58 ` [PATCH 08/20] Added a stubbed bind_mw API Bob Pearson
2020-08-15  4:58 ` [PATCH 09/20] Fixed error logic in rxe_req.c Bob Pearson
2020-08-15  4:58 ` [PATCH 10/20] Extended pools to support both keys and indices Bob Pearson
2020-08-15  4:58 ` [PATCH 11/20] Gave MRs and MWs " Bob Pearson
2020-08-15  4:58 ` [PATCH 12/20] Cleanup after git pull Bob Pearson
2020-08-15  4:58 ` [PATCH 13/20] add debug print statements Bob Pearson
2020-08-15  4:58 ` Bob Pearson [this message]
2020-08-15  4:58 ` [PATCH 15/20] Fixed a dumb bug Bob Pearson
2020-08-15  4:58 ` [PATCH 16/20] Implemented stubbed invalidate APIs Bob Pearson
2020-08-15  4:58 ` [PATCH 17/20] Implemented functional " Bob Pearson
2020-08-15  4:58 ` [PATCH 18/20] cleanup Bob Pearson
2020-08-15  4:58 ` [PATCH 19/20] fixed white space issues Bob Pearson
2020-08-15  4:58 ` [PATCH 20/20] fixed checkpatch issues for all files in rxe Bob Pearson
2020-08-16  5:29   ` kernel test robot
2020-08-16  5:29     ` kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200815045912.8626-15-rpearson@hpe.com \
    --to=rpearsonhpe@gmail.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=rpearson@hpe.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.