From: Leon Romanovsky <leon@kernel.org>
To: Doug Ledford <dledford@redhat.com>, Jason Gunthorpe <jgg@mellanox.com>
Cc: Leon Romanovsky <leonro@mellanox.com>,
RDMA mailing list <linux-rdma@vger.kernel.org>,
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
Matan Barak <matanb@mellanox.com>,
Yishai Hadas <yishaih@mellanox.com>,
Saeed Mahameed <saeedm@mellanox.com>,
linux-netdev <netdev@vger.kernel.org>
Subject: [PATCH rdma-next v2 08/20] IB/uverbs: Allow an empty namespace in ioctl() framework
Date: Sun, 17 Jun 2018 12:59:54 +0300 [thread overview]
Message-ID: <20180617100006.30663-9-leon@kernel.org> (raw)
In-Reply-To: <20180617100006.30663-1-leon@kernel.org>
From: Matan Barak <matanb@mellanox.com>
The ioctl parser framework wrongly assumed that each namespace is
populated. This could lead to NULL dereferences. Fix the parser to
always check that a given namespace indeed exists.
Fixes: fac9658cabb9 ("IB/core: Add new ioctl interface")
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
---
drivers/infiniband/core/uverbs_ioctl.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index ee15c9ca788b..fb12e8ef7147 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -201,6 +201,9 @@ static int uverbs_finalize_attrs(struct uverbs_attr_bundle *attrs_bundle,
spec_hash[i];
unsigned int j;
+ if (!curr_spec_bucket)
+ continue;
+
for (j = 0; j < curr_bundle->num_attrs; j++) {
struct uverbs_attr *attr;
const struct uverbs_attr_spec *spec;
@@ -248,7 +251,7 @@ static int uverbs_uattrs_process(struct ib_device *ibdev,
struct uverbs_attr_spec_hash *attr_spec_bucket;
ret = uverbs_ns_idx(&attr_id, method->num_buckets);
- if (ret < 0) {
+ if (ret < 0 || !method->attr_buckets[ret]) {
if (uattr->flags & UVERBS_ATTR_F_MANDATORY) {
uverbs_finalize_attrs(attr_bundle,
method->attr_buckets,
@@ -291,6 +294,9 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met
struct uverbs_attr_spec_hash *attr_spec_bucket =
method_spec->attr_buckets[i];
+ if (!attr_spec_bucket)
+ continue;
+
if (!bitmap_subset(attr_spec_bucket->mandatory_attrs_bitmask,
attr_bundle->hash[i].valid_bitmap,
attr_spec_bucket->num_attrs))
@@ -404,7 +410,12 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev,
* filled at a later stage (uverbs_process_attr)
*/
for (i = 0; i < method_spec->num_buckets; i++) {
- unsigned int curr_num_attrs = method_spec->attr_buckets[i]->num_attrs;
+ unsigned int curr_num_attrs;
+
+ if (!method_spec->attr_buckets[i])
+ continue;
+
+ curr_num_attrs = method_spec->attr_buckets[i]->num_attrs;
ctx->uverbs_attr_bundle->hash[i].attrs = curr_attr;
curr_attr += curr_num_attrs;
--
2.14.4
next prev parent reply other threads:[~2018-06-17 9:59 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-17 9:59 [PATCH rdma-next v2 00/20] Introduce mlx5 DEVX interface Leon Romanovsky
2018-06-17 9:59 ` [PATCH mlx5-next v2 01/20] net/mlx5_core: Prevent warns in dmesg upon firmware commands Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 02/20] drm/i915: Move u64-to-ptr helpers to general header Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 03/20] kernel.h: Reuse u64_to_ptr macro to cast __user pointers Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 04/20] IB/uverbs: Export uverbs idr and fd types Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 05/20] IB/uverbs: Refactor uverbs_finalize_objects Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 06/20] IB/uverbs: Add PTR_IN attributes that are allocated/copied automatically Leon Romanovsky
2018-06-18 20:48 ` Jason Gunthorpe
2018-06-17 9:59 ` [PATCH rdma-next v2 07/20] IB/uverbs: Add a macro to define a type with no kernel known size Leon Romanovsky
2018-06-17 9:59 ` Leon Romanovsky [this message]
2018-06-17 9:59 ` [PATCH rdma-next v2 09/20] IB/core: Improve uverbs_cleanup_ucontext algorithm Leon Romanovsky
2018-06-17 19:51 ` Jason Gunthorpe
2018-06-18 11:27 ` Yishai Hadas
2018-06-17 9:59 ` [PATCH mlx5-next v2 10/20] net/mlx5: Expose DEVX ifc structures Leon Romanovsky
2018-06-17 9:59 ` [PATCH mlx5-next v2 11/20] IB/mlx5: Introduce DEVX Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 12/20] IB/core: Introduce DECLARE_UVERBS_GLOBAL_METHODS Leon Romanovsky
2018-06-17 9:59 ` [PATCH rdma-next v2 13/20] IB: Expose ib_ucontext from a given ib_uverbs_file Leon Romanovsky
2018-06-17 10:00 ` [PATCH rdma-next v2 14/20] IB/mlx5: Add support for DEVX general command Leon Romanovsky
2018-06-17 10:00 ` [PATCH rdma-next v2 15/20] IB/mlx5: Add obj create and destroy functionality Leon Romanovsky
2018-06-17 10:00 ` [PATCH mlx5-next v2 16/20] IB/mlx5: Add DEVX support for modify and query commands Leon Romanovsky
2018-06-17 10:00 ` [PATCH rdma-next v2 17/20] IB/mlx5: Add support for DEVX query UAR Leon Romanovsky
2018-06-17 10:00 ` [PATCH mlx5-next v2 18/20] IB/mlx5: Add DEVX support for memory registration Leon Romanovsky
2018-06-17 10:00 ` [PATCH rdma-next v2 19/20] IB/mlx5: Add DEVX query EQN support Leon Romanovsky
2018-06-17 10:00 ` [PATCH rdma-next v2 20/20] IB/mlx5: Expose DEVX tree Leon Romanovsky
2018-06-18 22:05 ` [PATCH rdma-next v2 00/20] Introduce mlx5 DEVX interface Jason Gunthorpe
2018-06-19 4:59 ` Leon Romanovsky
2018-06-19 16:46 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180617100006.30663-9-leon@kernel.org \
--to=leon@kernel.org \
--cc=dledford@redhat.com \
--cc=jgg@mellanox.com \
--cc=joonas.lahtinen@linux.intel.com \
--cc=leonro@mellanox.com \
--cc=linux-rdma@vger.kernel.org \
--cc=matanb@mellanox.com \
--cc=netdev@vger.kernel.org \
--cc=saeedm@mellanox.com \
--cc=yishaih@mellanox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).