uverbs: prevent potential underflow

The issue is in drivers/infiniband/core/uverbs_std_types_cq.c in the UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE) function. We check that:

	if (attr.comp_vector >= attrs->ufile->device->num_comp_vectors) {

But we don't check that "attr.comp_vector" whether negative. It could potentially lead to an array underflow. My concern would be where cq->vector is used in the create_cq() function from the cxgb4 driver.

Fixes 9ee79fce3642 ("IB/core: Add completion queue (cq) object actions")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/infiniband/core/uverbs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/infiniband/core/uverbs.h +0 -0

index 1e5aeb39f774..63f7f7db5902 100644

Quoted 21 lines · Dan Carpenter

The issue is in drivers/infiniband/core/uverbs_std_types_cq.c in the UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE) function. We check that:

	if (attr.comp_vector >= attrs->ufile->device->num_comp_vectors) {

But we don't check that "attr.comp_vector" whether negative. It could potentially lead to an array underflow. My concern would be where cq->vector is used in the create_cq() function from the cxgb4 driver.

Fixes 9ee79fce3642 ("IB/core: Add completion queue (cq) object actions")

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/infiniband/core/uverbs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/infiniband/core/uverbs.h +0 -0

index 1e5aeb39f774..63f7f7db5902 100644

drivers/infiniband/core/uverbs.h ib_uverbs_init_udata_buf_or_null(struct ib_udata *udata, · line 104

Quoted 8 lines

drivers/infiniband/core/uverbs.h +1 -1

@@ -98,7 +98,7 @@ ib_uverbs_init_udata_buf_or_null(struct ib_udata *udata,
 
 struct ib_uverbs_device {
 	atomic_t				refcount;
-	int					num_comp_vectors;
+	u32					num_comp_vectors;
 	struct completion			comp;
 	struct device				dev;
 	/* First group for device attributes, NULL terminated array */

I would have expected you to change struct ib_cq_init_attr ? Or at least both..

This is actually a bug as the type of UVERBS_ATTR_CREATE_CQ_COMP_VECTOR for userspace is u32:

        UVERBS_ATTR_PTR_IN(UVERBS_ATTR_CREATE_CQ_COMP_VECTOR,
                           UVERBS_ATTR_TYPE(u32),
                           UA_MANDATORY),

But we are stuffing it into a int:

ret = uverbs_copy_from(&attr.comp_vector, attrs,
UVERBS_ATTR_CREATE_CQ_COMP_VECTOR);

So very large values will become negative and switching num_comp_vectors to u32 won't help??

The issue is in drivers/infiniband/core/uverbs_std_types_cq.c in the UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE) function. We check that:

        if (attr.comp_vector >= attrs->ufile->device->num_comp_vectors) {

But we don't check that "attr.comp_vector" whether negative. It could potentially lead to an array underflow. My concern would be where cq->vector is used in the create_cq() function from the cxgb4 driver.

And really "attr.comp_vector" is appears as a u32 to user space so that's the right type to use.

Fixes 9ee79fce3642 ("IB/core: Add completion queue (cq) object actions")

Signed-off-by Dan Carpenter <[email protected]>

---
v2: Change both types to u32

 drivers/infiniband/core/uverbs.h | 2 +-
 include/rdma/ib_verbs.h          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)