]> git.baikalelectronics.ru Git - kernel.git/commit
IB/uverbs: Fix possible oops with duplicate ioctl attributes
authorMatan Barak <matanb@mellanox.com>
Tue, 13 Feb 2018 10:18:35 +0000 (12:18 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 15 Feb 2018 21:59:46 +0000 (14:59 -0700)
commit08c1f40d09a86b71d33426bdf04c91ebcfe2c6ad
tree394a96ddf6867a6435398f840d310802fc4a0bbb
parent9a3dadf42dc4b836a723c9d2f32f689d6bf41c52
IB/uverbs: Fix possible oops with duplicate ioctl attributes

If the same attribute is listed twice by the user in the ioctl attribute
list then error unwind can cause the kernel to deref garbage.

This happens when an object with WRITE access is sent twice. The second
parse properly fails but corrupts the state required for the error unwind
it triggers.

Fixing this by making duplicates in the attribute list invalid. This is
not something we need to support.

The ioctl interface is currently recommended to be disabled in kConfig.

Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/uverbs_ioctl.c