linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Jann Horn <jannh@google.com>, Jason Gunthorpe <jgg@mellanox.com>,
	Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.9 07/26] RDMA/ucma: check fd type in ucma_migrate_id()
Date: Mon, 1 Oct 2018 00:40:33 +0000	[thread overview]
Message-ID: <20181001004026.147201-7-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001004026.147201-1-alexander.levin@microsoft.com>

From: Jann Horn <jannh@google.com>

[ Upstream commit 0d23ba6034b9cf48b8918404367506da3e4b3ee5 ]

The current code grabs the private_data of whatever file descriptor
userspace has supplied and implicitly casts it to a `struct ucma_file *`,
potentially causing a type confusion.

This is probably fine in practice because the pointer is only used for
comparisons, it is never actually dereferenced; and even in the
comparisons, it is unlikely that a file from another filesystem would have
a ->private_data pointer that happens to also be valid in this context.
But ->private_data is not always guaranteed to be a valid pointer to an
object owned by the file's filesystem; for example, some filesystems just
cram numbers in there.

Check the type of the supplied file descriptor to be safe, analogous to how
other places in the kernel do it.

Fixes: 88314e4dda1e ("RDMA/cma: add support for rdma_migrate_id()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 drivers/infiniband/core/ucma.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 3bef6d4ffe6f..0fd0d82f80d2 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
 
+static const struct file_operations ucma_fops;
+
 static inline struct ucma_context *_ucma_find_context(int id,
 						      struct ucma_file *file)
 {
@@ -1545,6 +1547,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
 	f = fdget(cmd.fd);
 	if (!f.file)
 		return -ENOENT;
+	if (f.file->f_op != &ucma_fops) {
+		ret = -EINVAL;
+		goto file_put;
+	}
 
 	/* Validate current fd and prevent destruction of id. */
 	ctx = ucma_get_ctx(f.file->private_data, cmd.id);
-- 
2.17.1

  parent reply	other threads:[~2018-10-01  0:46 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-01  0:40 [PATCH AUTOSEL 4.9 01/26] HID: add support for Apple Magic Keyboards Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 02/26] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 04/26] HID: hid-saitek: Add device ID for RAT 7 Contagion Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 03/26] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 06/26] perf probe powerpc: Ignore SyS symbols irrespective of endianness Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 05/26] perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx() Sasha Levin
2018-10-01  0:40 ` Sasha Levin [this message]
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 08/26] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 09/26] nvmet-rdma: fix possible bogus dereference under heavy load Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 10/26] net/mlx5: Consider PCI domain in search for next dev Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 11/26] drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 12/26] dm raid: fix rebuild of specific devices by updating superblock Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 13/26] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 14/26] net: ena: fix driver when PAGE_SIZE == 64kB Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 15/26] perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing CPUs Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 16/26] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 17/26] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 19/26] arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto" Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 18/26] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 20/26] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 22/26] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 21/26] s390/qeth: use vzalloc for QUERY OAT buffer Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 23/26] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 24/26] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 25/26] xen: avoid crash in disable_hotplug_cpu Sasha Levin
2018-10-01  0:40 ` [PATCH AUTOSEL 4.9 26/26] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181001004026.147201-7-alexander.levin@microsoft.com \
    --to=alexander.levin@microsoft.com \
    --cc=jannh@google.com \
    --cc=jgg@mellanox.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).