diff mbox

[v2,for,v3.13,8/8] IB/uverbs: check access to userspace response buffer in extended command

Message ID 6e858490596722a55c648abd8add25cd6343e0cf.1385981934.git.ydroneaud@opteya.com (mailing list archive)
State Superseded, archived
Headers show

Commit Message

Yann Droneaud Dec. 2, 2013, 11:12 a.m. UTC 
Just like vfs_read(), uverbs_write() must check output buffer
(eg. response) with access_ok(VERIFY_WRITE,...) to ensure
it's in userspace memory before using the pointer in uverbs
functions.

If the buffer or a subset of the buffer is not valid,
returns -EFAULT.

Note: there's no need to check input buffer (eg. command)
since vfs_write() does the check access_ok(VERIFY_READ, ...)
as part of write() syscall.

Link: http://marc.info/?i=cover.1385981934.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
---
 drivers/infiniband/core/uverbs_main.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox

Patch

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 8652c13f6ea2..0be1dd86f768 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -677,6 +677,11 @@  static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
 		if (response) {
 			if (!hdr.out_words && !ex_hdr.provider_out_words)
 				return -EINVAL;
+
+			if (!access_ok(VERIFY_WRITE,
+				       response,
+				       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+				return -EFAULT;
 		} else {
 			if (hdr.out_words || ex_hdr.provider_out_words)
 				return -EINVAL;