Commit 2dc7f114 authored by Maor Gottlieb's avatar Maor Gottlieb Committed by Zhengchao Shao
Browse files

RDMA: Verify port when creating flow rule

mainline inclusion
from mainline-v5.13-rc6
commit 2adcb4c5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4GV
CVE: CVE-2021-47265

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2adcb4c5a52a2623cd2b43efa7041e74d19f3a5e

--------------------------------

Validate port value provided by the user and with that remove no longer
needed validation by the driver.  The missing check in the mlx5_ib driver
could cause to the below oops.

Call trace:
  _create_flow_rule+0x2d4/0xf28 [mlx5_ib]
  mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]
  ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]
  ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs]
  ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs]
  ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs]
  do_vfs_ioctl+0xd0/0xaf0
  ksys_ioctl+0x84/0xb4
  __arm64_sys_ioctl+0x28/0xc4
  el0_svc_common.constprop.3+0xa4/0x254
  el0_svc_handler+0x84/0xa0
  el0_svc+0x10/0x26c
 Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)

Fixes: 436f2ad0 ("IB/core: Export ib_create/destroy_flow through uverbs")
Link: https://lore.kernel.org/r/faad30dc5219a01727f47db3dc2f029d07c82c00.1623309971.git.leonro@nvidia.com


Reviewed-by: default avatarMark Bloch <markb@mellanox.com>
Signed-off-by: default avatarMaor Gottlieb <maorg@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>

Conflicts:
	drivers/infiniband/core/uverbs_cmd.c
	drivers/infiniband/hw/mlx4/main.c
	drivers/infiniband/hw/mlx5/main.c
[The conflict occurs because the commit 8313c10f("RDMA/uverbs: Replace
ib_uverbs_file with uverbs_attr_bundle for write") and 6504c772
("IB/mlx4: Use port iterator and validation APIs") are not merged]
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 5dac66de
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment