]> git.baikalelectronics.ru Git - kernel.git/commit
IB/uverbs: Always use the attribute size provided by the user
authorMatan Barak <matanb@mellanox.com>
Tue, 13 Feb 2018 10:18:29 +0000 (12:18 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 15 Feb 2018 21:59:44 +0000 (14:59 -0700)
commitc5602def23e41ee39f47961fc8e585add558d70a
treeb57b20a7b70b6eaeef87f1c63f3a9aa3a0d92023
parent096394ea5e6fe2e9fbc55805a45770b0693d3c39
IB/uverbs: Always use the attribute size provided by the user

This fixes several bugs around the copy_to/from user path:
 - copy_to used the user provided size of the attribute
   and could copy data beyond the end of the kernel buffer into
   userspace.
 - copy_from didn't know the size of the kernel buffer and
   could have left kernel memory unexpectedly un-initialized.
 - copy_from did not use the user length to determine if the
   attribute data is inlined or not.

Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/uverbs_std_types.c
include/rdma/uverbs_ioctl.h