From patchwork Thu Jan 22 13:28:03 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yann Droneaud X-Patchwork-Id: 5684811 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 04578C058D for ; Thu, 22 Jan 2015 13:55:50 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 403552026F for ; Thu, 22 Jan 2015 13:55:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 60F292020F for ; Thu, 22 Jan 2015 13:55:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752655AbbAVNzm (ORCPT ); Thu, 22 Jan 2015 08:55:42 -0500 Received: from smtp3-g21.free.fr ([212.27.42.3]:17665 "EHLO smtp3-g21.free.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751146AbbAVNzj (ORCPT ); Thu, 22 Jan 2015 08:55:39 -0500 Received: from localhost.localdomain (unknown [37.161.221.91]) by smtp3-g21.free.fr (Postfix) with ESMTP id C3AA6A6347; Thu, 22 Jan 2015 14:53:09 +0100 (CET) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by localhost.localdomain (8.14.9/8.14.8) with ESMTP id t0MDYDpa009465; Thu, 22 Jan 2015 14:34:25 +0100 Received: (from ydroneaud@localhost) by localhost.localdomain (8.14.9/8.14.9/Submit) id t0MDXUh2009460; Thu, 22 Jan 2015 14:33:30 +0100 From: Yann Droneaud To: Sagi Grimberg , Shachar Raindel , Eli Cohen , Haggai Eran Cc: Yann Droneaud , Roland Dreier , linux-rdma@vger.kernel.org Subject: [PATCH 2/4] IB/core: ib_copy_to_udata(): don't silently truncate response Date: Thu, 22 Jan 2015 14:28:03 +0100 Message-Id: <3d22955e8011c770f052df8c1dba3ae776b55e6b.1421931555.git.ydroneaud@opteya.com> X-Mailer: git-send-email 2.1.0 In-Reply-To: References: In-Reply-To: References: Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP While ib_copy_to_udata() should check for the available output space as already proposed in some other patches [1][2][3], the changes brought by commit 5a77abf9a97a ("IB/core: Add support for extended query device caps") are silently truncating the data to be written to userspace if the output buffer is not large enough to hold the response data. Silently truncating the response is not a reliable behavior as userspace is not given any hint about this truncation: userspace is leaved with garbage to play with. Not checking the response buffer size and writing past the userspace buffer is no good either, but it's the current behavior. So this patch revert the particular change on ib_copy_to_udata() as a better behavior is implemented in the upper level function ib_uverbs_ex_query_device(). [1] "[PATCH 00/22] infiniband: improve userspace input check" http://mid.gmane.org/cover.1376847403.git.ydroneaud@opteya.com [2] "[PATCH 03/22] infiniband: ib_copy_from_udata(): check input length" http://mid.gmane.org/2bf102a41c51f61965ee09df827abe8fefb523a9.1376847403.git.ydroneaud@opteya.com [3] "[PATCH 04/22] infiniband: ib_copy_to_udata(): check output length" http://mid.gmane.org/d27716a3a1c180f832d153a7402f65ea8a75b734.1376847403.git.ydroneaud@opteya.com Link: http://mid.gmane.org/cover.1421931555.git.ydroneaud@opteya.com Cc: Sagi Grimberg Cc: Shachar Raindel Cc: Eli Cohen Cc: Haggai Eran Signed-off-by: Yann Droneaud --- include/rdma/ib_verbs.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 0d74f1de99aa..65994a19e840 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1707,10 +1707,7 @@ static inline int ib_copy_from_udata(void *dest, struct ib_udata *udata, size_t static inline int ib_copy_to_udata(struct ib_udata *udata, void *src, size_t len) { - size_t copy_sz; - - copy_sz = min_t(size_t, len, udata->outlen); - return copy_to_user(udata->outbuf, src, copy_sz) ? -EFAULT : 0; + return copy_to_user(udata->outbuf, src, len) ? -EFAULT : 0; } /**