]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/irdma: Prevent zero-length STAG registration
authorChristopher Bednarz <christopher.n.bednarz@intel.com>
Fri, 18 Aug 2023 14:48:38 +0000 (09:48 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Dec 2023 14:17:43 +0000 (15:17 +0100)
commit410c05b60c1af650b37ae45010086091f2d0cebe
treeca11ed45594526f1046d3d51d338474b4f21af8d
parent93e765523b34e47a794bfc94b05a864b5bd0428e
RDMA/irdma: Prevent zero-length STAG registration

commit bb6d73d9add68ad270888db327514384dfa44958 upstream.

Currently irdma allows zero-length STAGs to be programmed in HW during
the kernel mode fast register flow. Zero-length MR or STAG registration
disable HW memory length checks.

Improve gaps in bounds checking in irdma by preventing zero-length STAG or
MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set.

This addresses the disclosure CVE-2023-25775.

Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Christopher Bednarz <christopher.n.bednarz@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/hw/irdma/ctrl.c
drivers/infiniband/hw/irdma/type.h
drivers/infiniband/hw/irdma/verbs.c