From patchwork Tue May 31 02:40:50 2016
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Ben Hutchings <ben@decadent.org.uk>
X-Patchwork-Id: 9143169
Return-Path: <linux-rdma-owner@kernel.org>
Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org
	[172.30.200.125])
	by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id
	F06C360761 for <patchwork-linux-rdma@patchwork.kernel.org>;
	Tue, 31 May 2016 02:40:58 +0000 (UTC)
Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1])
	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D964B2793B
	for <patchwork-linux-rdma@patchwork.kernel.org>;
	Tue, 31 May 2016 02:40:58 +0000 (UTC)
Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486)
	id BA8112819C; Tue, 31 May 2016 02:40:58 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	pdx-wl-mail.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI,
	T_TVD_MIME_EPI autolearn=ham version=3.3.1
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7D3C62793B
	for <patchwork-linux-rdma@patchwork.kernel.org>;
	Tue, 31 May 2016 02:40:57 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1162295AbcEaCky (ORCPT
	<rfc822;patchwork-linux-rdma@patchwork.kernel.org>);
	Mon, 30 May 2016 22:40:54 -0400
Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:54517 "EHLO
	shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1161732AbcEaCky (ORCPT
	<rfc822;linux-rdma@vger.kernel.org>);
	Mon, 30 May 2016 22:40:54 -0400
Received: from ben by shadbolt.decadent.org.uk with local (Exim 4.84_2)
	(envelope-from <ben@decadent.org.uk>)
	id 1b7Zbu-0001JU-9K; Tue, 31 May 2016 03:40:50 +0100
Date: Tue, 31 May 2016 03:40:50 +0100
From: Ben Hutchings <ben@decadent.org.uk>
To: stable@vger.kernel.org
Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
	Doug Ledford <dledford@redhat.com>, linux-rdma@vger.kernel.org
Message-ID: <20160531024050.GL7555@decadent.org.uk>
MIME-Version: 1.0
Content-Disposition: inline
User-Agent: Mutt/1.5.23 (2014-03-12)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: ben@decadent.org.uk
Subject: [stable 3.2-3.16] IB/security: Restrict use of the write() interface
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on shadbolt.decadent.org.uk)
Sender: linux-rdma-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-rdma.vger.kernel.org>
X-Mailing-List: linux-rdma@vger.kernel.org
X-Virus-Scanned: ClamAV using ClamSMTP

This commit should be included in all stable branches:

commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3
Author: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Date:   Sun Apr 10 19:13:13 2016 -0600

    IB/security: Restrict use of the write() interface

When backporting, please fold the following change to the ipath driver
into the patch.

Ben.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -44,6 +44,8 @@
 #include <linux/cpu.h>
 #include <asm/pgtable.h>
 
+#include <rdma/ib.h>
+
 #include "ipath_kernel.h"
 #include "ipath_common.h"
 #include "ipath_user_sdma.h"
@@ -2239,6 +2241,9 @@ static ssize_t ipath_write(struct file *
 	ssize_t ret = 0;
 	void *dest;
 
+	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
+		return -EACCES;
+
 	if (count < sizeof(cmd.type)) {
 		ret = -EINVAL;
 		goto bail;