]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/ucma: Limit possible option size
authorLeon Romanovsky <leonro@mellanox.com>
Wed, 7 Mar 2018 12:49:09 +0000 (14:49 +0200)
committerDoug Ledford <dledford@redhat.com>
Wed, 7 Mar 2018 20:18:03 +0000 (15:18 -0500)
commitca81c24adc2416be4da8413d7a6d8e7b02ba77b8
treeaf65c6ba8416e2f3614680b8886c9eba97d82088
parent999f8f88fbe28d888a943b86fe35acbd5a0b88cb
RDMA/ucma: Limit possible option size

Users of ucma are supposed to provide size of option level,
in most paths it is supposed to be equal to u8 or u16, but
it is not the case for the IB path record, where it can be
multiple of struct ib_path_rec_data.

This patch takes simplest possible approach and prevents providing
values more than possible to allocate.

Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
Fixes: 840346d5075e ("RDMA/ucma: Allow user space to set service type")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/core/ucma.c