summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorLeon Romanovsky <leonro@mellanox.com>2018-03-07 14:49:09 +0200
committerDoug Ledford <dledford@redhat.com>2018-03-07 15:18:03 -0500
commit6a21dfc0d0db7b7e0acedce67ca533a6eb19283c (patch)
treeaf65c6ba8416e2f3614680b8886c9eba97d82088 /drivers
parentbb7f8f199c354c4cf155b1d6d55f86eaaed7fa5a (diff)
downloadlinux-stable-6a21dfc0d0db7b7e0acedce67ca533a6eb19283c.tar.gz
linux-stable-6a21dfc0d0db7b7e0acedce67ca533a6eb19283c.tar.bz2
linux-stable-6a21dfc0d0db7b7e0acedce67ca533a6eb19283c.zip
RDMA/ucma: Limit possible option size
Users of ucma are supposed to provide size of option level, in most paths it is supposed to be equal to u8 or u16, but it is not the case for the IB path record, where it can be multiple of struct ib_path_rec_data. This patch takes simplest possible approach and prevents providing values more than possible to allocate. Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com Fixes: 7ce86409adcd ("RDMA/ucma: Allow user space to set service type") Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/infiniband/core/ucma.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index f015f1bf88c9..1817dfea8345 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1294,6 +1294,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
if (IS_ERR(ctx))
return PTR_ERR(ctx);
+ if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+ return -EINVAL;
+
optval = memdup_user((void __user *) (unsigned long) cmd.optval,
cmd.optlen);
if (IS_ERR(optval)) {