Skip to contentSkip to conversation

IB/ocrdma: fix out of bounds access to local buffer

PATCH Applied Michael Mera 3 participants 3 messages May 1, 2017 2 messages not in the archive

Subsystems (2)
InfiniBand Emulex oneconnect RoCE driver
lore
Share & tools
lore

Michael Mera

author
#0 lore raw

PATCH 1/1 IB/ocrdma: fix out of bounds access to local buffer

In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is written at index 'count-1' where 'count' is the size of the write, so potentially 0.

This patch filters odd values for the write size/position to avoid this type of problem.

Signed-off-by Michael Mera <[email protected]>
---
 drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/ocrdma/ocrdma_stats.c +1 -1
index f8e4b0a6486f..66056f9a9700 100644
@@ -643,7 +643,7 @@ static ssize_t ocrdma_dbgfs_ops_write(struct file *filp,
 	struct ocrdma_stats *pstats = filp->private_data;
 	struct ocrdma_dev *dev = pstats->dev;
 
-	if (count > 32)
+	if (*ppos != 0 || count == 0 || count > sizeof(tmp_str))
 		goto err;
 
 	if (copy_from_user(tmp_str, buffer, count))
Signature · 6 lines
2.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 20170501064116.3900-1-dev-5Y08+B5RRAgbhb6IIWwbbQ@public.gmane.org

Reviewed-by
#2 lore raw
Quoted 4 lines · Michael Mera

In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is written at index 'count-1' where 'count' is the size of the write, so potentially 0.

Quoted 8 lines

This patch filters odd values for the write size/position to avoid this type of problem.

Signed-off-by Michael Mera <[email protected]>
---
 drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Thanks,

Reviewed-by Leon Romanovsky <leonro-VPRAkNaXOzVWk0Htik3J/[email protected]>

A message that is not in the archive (sent off-list or not yet received): 20170501085736.GW14088-U/[email protected]

Applied
#4 lore raw
Quoted 12 lines · Leon Romanovsky
Quoted 11 lines · Michael Mera

In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is
written at index 'count-1' where 'count' is the size of the write, so
potentially 0.

This patch filters odd values for the write size/position to avoid this
type of problem.

Quoted 8 lines
Quoted 5 lines
Signed-off-by Michael Mera <[email protected]>

---
 drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

Thanks,

Reviewed-by Leon Romanovsky <leonro-VPRAkNaXOzVWk0Htik3J/[email protected]>

Thanks, applied.

Signature · 9 lines
Doug Ledford <[email protected]>
    GPG KeyID: B826A3330E572FDD
   
Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html