From patchwork Wed Mar 28 07:35:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roland Dreier X-Patchwork-Id: 10312415 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5123C60467 for ; Wed, 28 Mar 2018 07:35:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3FD8529F00 for ; Wed, 28 Mar 2018 07:35:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 343B329F14; Wed, 28 Mar 2018 07:35:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 18C1B29F00 for ; Wed, 28 Mar 2018 07:35:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753278AbeC1HfV (ORCPT ); Wed, 28 Mar 2018 03:35:21 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:39672 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753369AbeC1HfT (ORCPT ); Wed, 28 Mar 2018 03:35:19 -0400 Received: by mail-pl0-f67.google.com with SMTP id s24-v6so1081022plq.6 for ; Wed, 28 Mar 2018 00:35:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google; h=sender:from:to:cc:subject:date:message-id; bh=YA8EDDns2rDEgNx7LPDcnqMANdyDWvRAXTiW4nk8yRo=; b=DGr74+i5ytoHG1WLRa/f6C1GMDe5Hk3F8se/IehNkuLiVsiYVUSSm6x4mvZopLe5ZS UsliwdsbGVIxQX5jeVNjjexGiX8Q4eUq7qZ1eTzIBTLnxdirH4QtVb8U0blPFnHgjTv+ VmLwykvBFMwfwNuDRyRBPan1rI+jhCpZyWjR0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=YA8EDDns2rDEgNx7LPDcnqMANdyDWvRAXTiW4nk8yRo=; b=mXeoH+DOLSjIgI1iIrBNz3FnR7Ux4ee7u6tjof7iW1O+SUAoTkugB9NAKue9bRwC8G AUb3PVYtoFp4JnurrygG4WylavwVNH1kUToWbO7l5F7otvhW0wKQYHh7dSkj32zQnt4z im76sIyaXKRfQzeNXRE40dK8A1Zj8fWNywmYkZEHOs3V2+cDWkdjWuWJRb3XzDueAKkS +XGS3WJCvcTt+GLlWHfnS9gLP+LBLlMJH6gr9aAsrugykeGKwuxvFmrbiFBYSYu/El5Q v7ItV+7HbR2c0u4tJHcSTx552AH6HgUObS34IyKw1YGYCnkmjf9TMrbPwEJ7Fh6SYlT7 OzJA== X-Gm-Message-State: AElRT7EgD/cF1ql4ppf2/mK4z3xfKUNUM4BMI0FheazHEazdQsK+TlMc QX27kjQzPXrzVS+4d8C0a70FoQ== X-Google-Smtp-Source: AIpwx49VXKgF/Wd4zmv8OdIJfkYJh6BAKVtaHmLfZph8ksscNtjf2WIh3aaAwh2o3qkmCaHtRCoOiA== X-Received: by 2002:a17:902:be12:: with SMTP id r18-v6mr2710893pls.8.1522222519009; Wed, 28 Mar 2018 00:35:19 -0700 (PDT) Received: from roland-x1-yoga.purestorage.com (c-73-162-189-82.hsd1.ca.comcast.net. [73.162.189.82]) by smtp.gmail.com with ESMTPSA id c189sm7287423pfg.72.2018.03.28.00.35.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Mar 2018 00:35:17 -0700 (PDT) From: Roland Dreier To: Doug Ledford , Jason Gunthorpe , Sean Hefty Cc: linux-rdma@vger.kernel.org Subject: [PATCH] RDMA/ucma: Don't allow AF_IB in ucma_join_ip_multicast() Date: Wed, 28 Mar 2018 00:35:13 -0700 Message-Id: <20180328073513.5294-1-roland@kernel.org> X-Mailer: git-send-email 2.15.1 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Roland Dreier If userspace passes a sockaddr with sa_family == AF_IB to the ucma join IP multicast command, the kernel will memcpy() past the end of its buffer. Fix this by checking the addr_size we get back against the sockaddr buffer sizes. Reported-and-tested-by: syzbot+6800425d54ed3ed8135d@syzkaller.appspotmail.com Signed-off-by: Roland Dreier Reviewed-by: Leon Romanovsky --- drivers/infiniband/core/ucma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index e5a1e7d81326..565efa8f43a5 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -1427,7 +1427,9 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, join_cmd.uid = cmd.uid; join_cmd.id = cmd.id; join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); - if (!join_cmd.addr_size) + if (!join_cmd.addr_size || + join_cmd.addr_size > sizeof(join_cmd.addr) || + join_cmd.addr_size > sizeof(cmd.addr)) return -EINVAL; join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER;