]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/ucma: Limit possible option size
authorLeon Romanovsky <leonro@mellanox.com>
Wed, 7 Mar 2018 12:49:09 +0000 (14:49 +0200)
committerSasha Levin <alexander.levin@microsoft.com>
Wed, 21 Mar 2018 03:49:49 +0000 (23:49 -0400)
commit2f8923db64bb526bf12c31b33095196f15a47af9
treef83ca5e43e82d4ae522250145a6b0a26a2fb3a56
parentbb95ae81bf5e09e040f350bd9d312c7cb9dd1c48
RDMA/ucma: Limit possible option size

[ Upstream commit 6a21dfc0d0db7b7e0acedce67ca533a6eb19283c ]

Users of ucma are supposed to provide size of option level,
in most paths it is supposed to be equal to u8 or u16, but
it is not the case for the IB path record, where it can be
multiple of struct ib_path_rec_data.

This patch takes simplest possible approach and prevents providing
values more than possible to allocate.

Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
Fixes: 7ce86409adcd ("RDMA/ucma: Allow user space to set service type")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
drivers/infiniband/core/ucma.c