| commit | 89d9e8d3f14d807bbd7725f8f6f5eeb7f6f5c42f | |
| author | Matan Barak <matanb@mellanox.com> | |
| Tue, 13 Feb 2018 10:18:29 +0000 (13 12:18 +0200) | ||
| committer | Jason Gunthorpe <jgg@mellanox.com> | |
| Thu, 15 Feb 2018 21:59:44 +0000 (15 14:59 -0700) | ||
| tree | b57b20a7b70b6eaeef87f1c63f3a9aa3a0d92023 | treesnapshot (tar.gz zip) |
| parent | 415bb699d793f7ad9c67c04a766d1e655fa6b203 | commitdiff |
IB/uverbs: Always use the attribute size provided by the user
This fixes several bugs around the copy_to/from user path:
- copy_to used the user provided size of the attribute
and could copy data beyond the end of the kernel buffer into
userspace.
- copy_from didn't know the size of the kernel buffer and
could have left kernel memory unexpectedly un-initialized.
- copy_from did not use the user length to determine if the
attribute data is inlined or not.
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This fixes several bugs around the copy_to/from user path:
- copy_to used the user provided size of the attribute
and could copy data beyond the end of the kernel buffer into
userspace.
- copy_from didn't know the size of the kernel buffer and
could have left kernel memory unexpectedly un-initialized.
- copy_from did not use the user length to determine if the
attribute data is inlined or not.
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
| drivers/infiniband/core/uverbs_std_types.c | diffblobblamehistory | |
| include/rdma/uverbs_ioctl.h | diffblobblamehistory |