From patchwork Thu Nov 4 15:23:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marciniszyn, Mike" X-Patchwork-Id: 12603371 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14C06C433FE for ; Thu, 4 Nov 2021 15:23:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EE30D60524 for ; Thu, 4 Nov 2021 15:23:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231265AbhKDP0Z (ORCPT ); Thu, 4 Nov 2021 11:26:25 -0400 Received: from mail-bn8nam08on2101.outbound.protection.outlook.com ([40.107.100.101]:21537 "EHLO NAM04-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S231283AbhKDP0X (ORCPT ); Thu, 4 Nov 2021 11:26:23 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aVJbji2cWYH/h1dluO+BCVdjYP/yKNe0WI53QflJByjSKx9cMc6ASU6UKshmOVCpwo8Hw8mV606wIeiRxk62BovPIy7wNLa5VTh70X8gxbq19x1NYJe3uNHaICM9TpPTxa+MMRycqcHKh3AZ6tVFCbn/y21oBZvK5eRyMGuy5t0eydK4IFyIa2vYCDNew6mx7nNbVCUIng9WWprIE1aJsoMIwRoOFvPe2khOqD6qfpDXL83H5gqQNGf5B6rAfE3kEjHOgCcLyjY0gWAugESC+EgOjKnC19n9d+ZeuS6p0w7Lb9JEHhL6emU06e9TEkIvZ9v/1x4FPXyiq7epnUXVtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Dov9bT6osIFT3vlrbvXm6FygaGFhd9kwnbAF+vmUPik=; b=k1N2QaPUBmRiydy1k6QxP5BnxkydS1U0xjMIZ4gcTV6OL+lHECQOc84CbsfoIys6pcmbRATsQyVDmKm33jq5FlHJ92Ghr6nAf0YYYaNt4l+U+mbtwvmXDee5QKJNhDahcBEDkIRZ58d84447aay1aGZpov/O7UPZnwqw+7r6QzSle2QpzwsjebchWzgEI1V6k4wlAs7zhfugvnOv/HeWdl2PdZUBj73YNMPUFuezogen+Zf/RENylYVt8yJpIXq7SVK3K75q1sSvL4EfSrbXx8K34IgIkWiCacfkUp7MFXQ6419hYSVyBfxB01O0CXUJI1aqAbVLk76sviN001R4Uw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cornelisnetworks.com; dmarc=pass action=none header.from=cornelisnetworks.com; dkim=pass header.d=cornelisnetworks.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cornelisnetworks.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Dov9bT6osIFT3vlrbvXm6FygaGFhd9kwnbAF+vmUPik=; b=eEFReEtBsmGRAWXrAEW8AefP3ww/cx/CjWeg25K7THeMkJuJDsmkVPuDlaCXhmY5xYGSyjIw3vJbGjTD83i0zboS+sxPEE+gkXr9Ant4Notv1tOZZ5liLjG0zpYPAdasldkiUQlEND4y8ioTzgQY+iNNTTa8oNVxAWPYUGIDH+HMo8lDMLNXlBRB7RELjLuBZxxdJBXXC8A9Nn0DHbZHa4vKM5o1X95q9+me5KCVJ3JRaB/JgF+UqpOQ7CClKk6gXevLWp+RuU6XKdwXTn+OVzAQAWO4YLOTwoZgstqoE3nVpOSvHsu1S2Gi4/vXREEa3hwsGB7y/1ThDiIkvT22jA== Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=cornelisnetworks.com; Received: from CH0PR01MB7153.prod.exchangelabs.com (2603:10b6:610:ea::7) by CH2PR01MB5767.prod.exchangelabs.com (2603:10b6:610:44::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4649.17; Thu, 4 Nov 2021 15:23:41 +0000 Received: from CH0PR01MB7153.prod.exchangelabs.com ([fe80::bdea:4e22:1b89:24e0]) by CH0PR01MB7153.prod.exchangelabs.com ([fe80::bdea:4e22:1b89:24e0%7]) with mapi id 15.20.4649.019; Thu, 4 Nov 2021 15:23:41 +0000 From: mike.marciniszyn@cornelisnetworks.com To: stable@vger.kernel.org Cc: linux-rdma@vger.kernel.org, "Gustavo A. R. Silva" , Mike Marciniszyn , Jason Gunthorpe Subject: [PATCH 4.9-stable v2 1/2] IB/qib: Use struct_size() helper Date: Thu, 4 Nov 2021 11:23:35 -0400 Message-Id: <1636039416-138753-2-git-send-email-mike.marciniszyn@cornelisnetworks.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1636039416-138753-1-git-send-email-mike.marciniszyn@cornelisnetworks.com> References: <1636039416-138753-1-git-send-email-mike.marciniszyn@cornelisnetworks.com> X-ClientProxiedBy: BL0PR01CA0011.prod.exchangelabs.com (2603:10b6:208:71::24) To CH0PR01MB7153.prod.exchangelabs.com (2603:10b6:610:ea::7) MIME-Version: 1.0 Received: from awfm-01.cornelisnetworks.com (208.255.156.42) by BL0PR01CA0011.prod.exchangelabs.com (2603:10b6:208:71::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.10 via Frontend Transport; Thu, 4 Nov 2021 15:23:40 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: a2cbd15a-d125-45ac-95e9-08d99fa714cc X-MS-TrafficTypeDiagnostic: CH2PR01MB5767: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1332; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: KHecnaTi+rHo+vmOiBd3FVtj2TGhYfmGlwrWlBqVfYRZlZjMWVbIcFi+Z4AcGtzl6/VNqIqiq/IGctExYhxrFBFlhsKTPBxQjP86pBBRxhus6xJJ+qcYMGA0SIiD+51JDN0nmPU1CFJ2qOp/bUyCXhTk/W/B7OD2VamiBjE6lk/DJnWgiS08qxqUYRKGJFfV9MtCzI4yKbdPOVzdfOv2iNZdgzeXDgiiJLy5nCjEIpSkPcMjbI4icEgiXHStFpsB80a6s0bhUYjx+6bk8N6zp23Bj3IQNhuErBWoU1OA6ULpLBYwBP9Y4NlpaeN08ki4iMkrJmf++BG6sYH+Kj+kWMf8CmWz0v73PpecC6gJKMSO16v6cMmXLgjqgRwKlvl1JwJ9Y6E6MWnLLxHOTQ+Vfd3Z9Fslgylb5N83cM7xPfhdLQTMAvDtj4WeLxoHVByEFD+coOR9SI3ii64DoBMcYbTB3VWhpt9z4aysmvuX/Gfdzkb8/O3dTaWB4wForTRqz/KLcyn0KKAV0F898Lz0+/In+6OXUyZ2vFqUTRZO/PmCH1Ly+X7aTmLJiSuO8tPiq6NeteN/bLPy3S93gkeoHqf2H7D72yj3oUrAkOMpB8DU4SpLsm/KLC1yWIatz3e4r0+t9asXXboCpGWYX/XjJDFQOujg03Wb6HWUzILPJ9blGweP4BpgPFjHHUF9jcEZV4GFpqgFEpKbfzpvK/X7iw== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH0PR01MB7153.prod.exchangelabs.com;PTR:;CAT:NONE;SFS:(4636009)(346002)(39840400004)(396003)(376002)(366004)(136003)(5660300002)(2616005)(66476007)(186003)(6916009)(8676002)(2906002)(66556008)(38100700002)(38350700002)(83380400001)(54906003)(6486002)(6666004)(956004)(66946007)(52116002)(7696005)(9686003)(316002)(36756003)(86362001)(26005)(8936002)(4326008)(508600001);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: rfC56gBjpvbX6TN3cGBtSv4CPQXIw+/833T5qtqMp1TkGcoiSBVmdSr5dIBVa4grS2XSDFNxJOszjkMt4KHzqN24Utn1/QisUVkm5zspeWXXUBYyKkqI6Vgz7QV/DPsnbT3sApmW6lgmq6Nb/vDYDB1Fu7o5Be/ltDs7oonrSZ7dxRS91ti78z31E+zDQkO9N9FwGK/KHtABD267DlBwo6TYukJACiFg2h5oIHXbLJX7uqFVOChclXAMpyhhPJ/OfMY8pf4Tzl34UBC/V0oFje7/OVXmyoh5fTJTqTyq+U6pv56FAxgUoZjHph9T8MdC2B+ap7i6gRj1gD69t+dKiYzw2jO6ri3A+LHsOurdgz1M9Wg8FPP4M00MaDy5qWPp+UgUmL4leL9E9XJNhKFvztml6k/aTUE82+2YsPElVIZ8BNre9J6lTZkPk1xI6eWUaAgKnIFLSo5DAVkgza/uJ1Ha8XXmh0wkYwM7ZR8t5jS9DnIioQWKR4MVSMF4yFYLZZQdqqyK+rAYY1EEgo2OGxOVm0FDWUlNjycyCubjT5eIiIg+kzFF+6Y+pPK16T9N6bXn5t3mwyHWpnD64I4OFlsog17ZqUTfTZ2eb+QAc1tVnOREQQcIW1YA0KjOXK8fh+y7z7DZQQ9/R4A8WvakTcqiK/sf0D/ix3Kx0Ho7l+tjluRFzltG+0kx64qmtGB1S9WJoOJZkXGPck9Qa6tgWFlBevPSavHyPtLdA8EqfOHegAr98W/bwpJS97L2XoUhDNMn0/SN78HdCs0EMXyjPjtUszfqNs632MQ2GzuOfb2NdSbH0D27hgHPRlUjEJmUW3+b/tfWpAFy6BZXzvbCU14eu1IZ1AGBiq9Xwlvc3n3wwpLDn1bz4hdmGAzWCRsFBlRoOqWpjauW40v/t6/V6TY1wR/C+lHEcvFi9AQV1t387R5WyI38nUW1xflmuo1t3Esqj2VOnDyu52f82mOXSj+B6eFYT0dXzzPj3iyth9kfj5AbELbZ7odeZnbgZHRpbi/0wGvbN17T52Zwp7aLFvCVYdrdFxTiCpRqcdx5ZX8Yzdjv0nolyPMwsS9+37eM5f23PCS0eNI+8v32WrywqJQgxsvzNXm0jj6Ht4Z/OUzMSHkoUF1oh/NBvpE1wwMov7qDlBpfz3umNRftBOnYxEPPWkLPSA/6Y9GJCp01JNntzxVSH74qkrm17NcnNTIfUt+xc8jxD2BqN1a6FZofCCdv7k5PjeUzJlm1cFLt+JRbUoDWBFk8j2BXaw2DxGqPS3kS55PC/MG+QbBXtrePegKWOw5s6J1ix8uAO/3b78oOV3tknFfHwEZ1BJrvlPLZbk0cOr7btxORGXNhs8W78XEYkvaYKEw7KcCziajrNXppvK2VOWXzQnj19oAOIbQCwFraQEtxWHKtSwLtjZp816NvFsFrgSU/pD4OdRC/s189uD9lmuNja0PDE9qBOdCc8T2WTafK7Z3ubvASzOkYs49fAAsNLVRCVx41pioUWemf72txJk/2wGqyy7N3fzsUTtYBkSDEEY6idY7BbJTpsUTBF3kkn25d612XvGeBwPfGMzmGMF2eAOvfp7bfh2DMl5Kc6533n5tcLcaBdgU3fW3AIP7VIXd0bANs5qjVTg9RzdWVMvjiM2gX036HLPUbNwbTenVH4RNDhn9X8jb8Sj8GuGa+zApaRZ6Lu6Rong6yB/vdq3oDqtP5KHA9bXC5I/8OyQyp5lioDWx4QEaxEA== X-OriginatorOrg: cornelisnetworks.com X-MS-Exchange-CrossTenant-Network-Message-Id: a2cbd15a-d125-45ac-95e9-08d99fa714cc X-MS-Exchange-CrossTenant-AuthSource: CH0PR01MB7153.prod.exchangelabs.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 15:23:40.9521 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4dbdb7da-74ee-4b45-8747-ef5ce5ebe68a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: n+HEubjcrAevBYhszja5zmAhyaFobPBBy/cBespgvmlFDypr4UhOAxF0P2EyhLuv7iy0ATbetCkbUUgFXO+5m+zcRkQQTARj3DbZFrI/Iew+0gWkb/hPN1b3V86q43o7 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR01MB5767 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: "Gustavo A. R. Silva" Upstream commit 829ca44ecf60e9b6f83d0161a6ef10c1304c5060. [Apply to 4.9.x] Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace the following form: sizeof(*pkt) + sizeof(pkt->addr[0])*n with: struct_size(pkt, addr, n) Also, notice that variable size is unnecessary, hence it is removed. This code was detected with the help of Coccinelle. Backport notes: - required include of linux/overflow.h Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe --- changes from v1: Correct signed off for Mike Marciniszyn --- drivers/infiniband/hw/qib/qib_user_sdma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c index 3e0677c..deef6ff 100644 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c @@ -41,6 +41,7 @@ #include #include #include +#include #include "qib.h" #include "qib_user_sdma.h" @@ -908,10 +909,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, } if (frag_size) { - int pktsize, tidsmsize, n; + int tidsmsize, n; + size_t pktsize; n = npages*((2*PAGE_SIZE/frag_size)+1); - pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n; + pktsize = struct_size(pkt, addr, n); /* * Determine if this is tid-sdma or just sdma. From patchwork Thu Nov 4 15:23:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marciniszyn, Mike" X-Patchwork-Id: 12603373 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99C4CC43217 for ; Thu, 4 Nov 2021 15:23:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7EF6B611C4 for ; Thu, 4 Nov 2021 15:23:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231396AbhKDP00 (ORCPT ); Thu, 4 Nov 2021 11:26:26 -0400 Received: from mail-mw2nam10on2091.outbound.protection.outlook.com ([40.107.94.91]:51841 "EHLO NAM10-MW2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S231325AbhKDP0X (ORCPT ); Thu, 4 Nov 2021 11:26:23 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cKZ3Y+LJMUQm97uiOGxd/GsccLzBfITSUNtssZNqs9UXdoRaD/QKuunZBQaOHsSquYsLj5pGn3MsllkEuG2WlhMHHlRDReBbPhCK6YlY49quHNv6sc8FL5CgzHy+XPTX2xWJWvzCBcBkMYqRkqW2AZcLSdvoQItkZc9QoW/hb0N5KugPs2JPhmnhOKQPkZg2U21eUqZA+ZZoPqJtZm3hZ0nfPenffrY/zGIqPvBox1f/6S7k/hCFlfimTW8PWRMD+yKef5vE3DJkvSch8aqm3RQgSRs3ZxFHNqgKUhTFozIIhJukbRBOYC6seAAKt1SPhXfYXyzg3/gYyah7zK/MiA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HRpu4CaaILQYhn6i+wiqTdkFK0+wY7VP0Tx38dsQA68=; b=jQ7nHNc+VmmIcwaKeJEbxAQ6DvE82KK/Z8ePiZmxmdtgwmsnLcu9hkIUkxpec8tC5IZxonDFt6Qfdqt9wr+YD/M3dj2wTWYz3m4Z3uXYqEUkfOXGTUPHjcgrX4CDT+FYjY4yzx24Po5HiUlV279UyTyPcOJ66PeLnBoAm1M1/gkL30huR3679wjlO6ric2dI0a8X2rDlDirha0tYDcZ3uuhHULpk21FXVJ9kvrNMsPC/8p0HydCEQnltGAqHpng6yB3lnqGZJd9/4FC53gJJkgxraNjIpCVlApGSS86ThajgORSYe7CM/PTkyfFasp011RSta9Mf0vh0+SLwmbRAWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cornelisnetworks.com; dmarc=pass action=none header.from=cornelisnetworks.com; dkim=pass header.d=cornelisnetworks.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cornelisnetworks.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HRpu4CaaILQYhn6i+wiqTdkFK0+wY7VP0Tx38dsQA68=; b=G7yTMK6dObt5Dm27dT1hwMIn/mIAZPmXy33m6sdnQLLeD9xI1b10wde0nh+0OjuEn496tv6j87IfmCyTFsTuTMxqW4h3uMwCwAMGxZ0jBkLg9k69VW2qUn8qLqoEyiNxzSx8duYuG1lxaWJu+8zt8usPYjhM/wwUrXqyI04gmiDJdCmYYtKWFrenmcHui+5Oec7whn8D7n590xyndLid/BosHHa0kPfRqxwzBAL4G8Aon834VS/L7gRATnp/MqV7asEAs1dGNosQIi4jEGEh3ATVU4myct+d/kgQtO+A5e3IjRpZya/km0uLEVPVbWYzO/yKqNH0vmHoPeIUN9S/uw== Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=cornelisnetworks.com; Received: from CH0PR01MB7153.prod.exchangelabs.com (2603:10b6:610:ea::7) by CH0PR01MB7139.prod.exchangelabs.com (2603:10b6:610:f6::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.11; Thu, 4 Nov 2021 15:23:41 +0000 Received: from CH0PR01MB7153.prod.exchangelabs.com ([fe80::bdea:4e22:1b89:24e0]) by CH0PR01MB7153.prod.exchangelabs.com ([fe80::bdea:4e22:1b89:24e0%7]) with mapi id 15.20.4649.019; Thu, 4 Nov 2021 15:23:41 +0000 From: mike.marciniszyn@cornelisnetworks.com To: stable@vger.kernel.org Cc: linux-rdma@vger.kernel.org, Mike Marciniszyn , Dennis Dalessandro , Jason Gunthorpe Subject: [PATCH 4.9-stable v2 2/2] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Date: Thu, 4 Nov 2021 11:23:36 -0400 Message-Id: <1636039416-138753-3-git-send-email-mike.marciniszyn@cornelisnetworks.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1636039416-138753-1-git-send-email-mike.marciniszyn@cornelisnetworks.com> References: <1636039416-138753-1-git-send-email-mike.marciniszyn@cornelisnetworks.com> X-ClientProxiedBy: BL0PR01CA0011.prod.exchangelabs.com (2603:10b6:208:71::24) To CH0PR01MB7153.prod.exchangelabs.com (2603:10b6:610:ea::7) MIME-Version: 1.0 Received: from awfm-01.cornelisnetworks.com (208.255.156.42) by BL0PR01CA0011.prod.exchangelabs.com (2603:10b6:208:71::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.10 via Frontend Transport; Thu, 4 Nov 2021 15:23:41 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 406c36ce-bfeb-4fdb-8363-08d99fa71539 X-MS-TrafficTypeDiagnostic: CH0PR01MB7139: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:459; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: /M/y/Qy9fqhoqpsxB3lxisb6VuEAqxei1/u5avoFr49SHD5fIlzzhLFdMWjEgKDJJGesUFLCDR8jZfhWX5Xl9An9nhGB3JmhDfvbDutAeiciMTy92c//daZM7cqaM8QtAs9YN8vUWbmFkcEf7FiDMYms60a7HFkofX0BMfFUh6QpX9vyyIVmUxJ7oeNnhLZ/mCrK+0RcRW3/KKVgiK4FMlq8fRwxUW/+7qufouwa6lR2LODPsdzknb+gX976xMc7Ifu6I26dXL79byIZFhKpF3XHs15CJ4J20DRO5geaQQFD8BWBSdLxMS+PwELsTbXVNsi2z4AQ9Yj5PbyZCy8/zAMOEZ+6iTkvXqjPwQgZwzWfcCvpMqzkIvR3fQSCTC1RaHBhJ6OXsOwHjKK/biSwWlEt7HwOaRBv5+NzZrYglCJ1hvpHkuiS6VerDTAHzWazstxSJEvs43TLo8+jsErSXmir3k5AnpIOUWYMgjsgqms+jkuNnhWkkoBggGeXV43XAW+RZbC/1FRqlmCfEMlfktFuzl8Yh2NGILtlRbc3m466Xza/VEZzxSKcC2twTO+ixnT2X4IRPluaXWFsvgD/HRAs612U6H5fP/HNmYcEml2XxwGkVoIHxcUlJ1oLW+4OwTk9rH7S64/rA0fGxXPiQOPgOcYgntfjAbyUn04NG2joiXtkHicDECGuG6pX4WMq/RmTO30kT9tWlMJNt7Ay/tmQGUR4ZNf/A34v6rUvGELqMYvC5dqzVq8Dy+PYywWUFWfEc2xTtpUSfht0KQBxLj2JvasuOW1pySSbWUHSqso= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH0PR01MB7153.prod.exchangelabs.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(136003)(366004)(346002)(39840400004)(376002)(86362001)(83380400001)(5660300002)(6916009)(38100700002)(9686003)(38350700002)(186003)(6666004)(508600001)(966005)(4326008)(8676002)(52116002)(7696005)(26005)(6486002)(54906003)(8936002)(36756003)(316002)(66476007)(956004)(66946007)(2616005)(66556008)(2906002);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: eSO9aj6qBt8cBg6mn1wOmtIXGzFA1cbwDhcApKnKXGZTlyHSKrugNYeQpFsCxDxUoHwU1ENaOMEzNfbffEbarmndA1H2LW42ZF2QaSe2UkdU9ZlsXkdWxGyhhLNMlrNZmguAU8An4yqSoIkiM209x+F0qUhnYLnd0GylS3J051c0r8eg0IFtwzXoWOHIliy/ouZUE7Y5j9ECJu7sud7UDP0nuKxSeS91vDcurVmHBd7nixFZzfO81UT7spPsMBJP7Xypc+i++qrKmwhtu8Vp3oi7UE5sRddZDJhdClrbaVxJssyW9kpsxEvbaMF9jV+c5ClgA8adYqB2OTgji8KPyDfMr0Go6O/yIZhSoexZ36JUYKyp6g+gKeffIdZZs4j4ihCWc+aQPJAWIJRMLNDiyCXIgxlA/t9D7oql08haJ8meXjkPjvU2SUeKzML2NI4Vom9c/LCOvSF4meC4yc3t+ip/T2dVqOokIZ5WOihV4RCcMEcMBpBVIlP98a4zCSvZHmYv3IENLNizlXtVPvt+kO+wtEVnwjfDNqxHa7cTFszXPhMQLfTbVuxPVDbEF5QVRT/FES7JDsSzRdic88GNaunhXuoV/0uwdGO6IEjeK9F4aEd7V5V9ef0hafkfyQSjWhMWKkVJhQ5Ii4uSxZwvqduehel25BE7D6zdFSq7IXmPQWEr9wP13LxYoHTAW0V87Us5Vr8gM6kvm/t444tQC4DYq4rY1TmvxcBas2H4T5QbAvwT/TmEy5MqlNbo1potJgDtn9NtRl8QrmbV3E3w/e3bh6prk6EX9LWt8luVFCpqPa05Lp7jStWWvj8WhTrTx2eKZYboxx3O0L6RjN2jNPFP1u2d/IoXu64crYsIBOcbFUrWBNvrKd+c0AlmfehTxi943iqVYuRfYfX88Fb9OixiAdlSlCpNyua6/qJoCGFt1cDRX7KkORWcArtmpgqxhXyBnD085O6rsBJ9ZKgeSYLJn6BcQXKGbAwriT3Pf/acpJ85X5ZJ0Yrxq9hQGnGKw40iTcbxUPG/K66xSjxhN3dlOr9LFamA+McOygphlEWOKI8UNAw0heToNqT8IYUtYp7T6FFSunBGbzspAKzuqQ4BI8VzxVd3tkBhy4wrq7HQpk3nOMIXsK0iJfXAUE7i2RsEmBfbiIm8IC4smOAavDRN3pe/7Ikfpar1JBeBt8zEBvDkF6z4P5iLbACGZoZjkGDVJ1Vdd+sfYaPHWKtkq1FauMJNenAZUhN7z4SYgKaOXwwmBgTKoJ+FwLHXYCLzpdyR5a+TzimHwZ508/vLkCfI8yrSHyMs9ztEoj3onXCoXH1prqRSOQO2QHdR24cdDz8yZ0hVh1xV70gw+fu61AvcEu5wNutIUReRUIfamOcUFRU9vlci1nzPrBD37WWmabKVwkXfJPJPT7HSKUa+84ilD92XrqSbjYJ6HMy3wlP11+U8vArUjsAEJ/VwVnPxBb2xzQ/Y2Rj5o5RNWXDTT09eatia4RrtL5q2TpHrRDLu6b9DVzK+g0pv5LHh7tSKTOBu0UtgwO3ZcvzNaWhlFPawkswr/VWhVHmmVuaBaCKxNUx6TatBYsksGP4OlmX1NgtEIRifMtiR/Q67OfgVWK0owBDWPJ6O1i4Xn+vnJ8c90vYooISEAbGq/veX8NO0nbKk++YCVMggOC1WjmUxB9AtTtXpzQ3roFTUzWkEJ1sNlbyOCO8UrzjtymQ1PNVAp6Pio26gOdbkqudajyrgeQ== X-OriginatorOrg: cornelisnetworks.com X-MS-Exchange-CrossTenant-Network-Message-Id: 406c36ce-bfeb-4fdb-8363-08d99fa71539 X-MS-Exchange-CrossTenant-AuthSource: CH0PR01MB7153.prod.exchangelabs.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 15:23:41.5943 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4dbdb7da-74ee-4b45-8747-ef5ce5ebe68a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MsIZAiypqZPp6GcTgM2EKxtT1VDs6PvLiHZxo9lkccwgWGLh1AyKCZvKpywqE3bsjhgLRLkZalo88mAzJHjyaXfaZnROlZSexezGb2SJAXx9y1eDm6uv4hB0R+rTaHVf X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR01MB7139 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: Mike Marciniszyn upstream commit d39bf40e55e666b5905fdbd46a0dced030ce87be. [Apply to 4.9.x] Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers. Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") Link: https://lore.kernel.org/r/20211012175519.7298.77738.stgit@awfm-01.cornelisnetworks.com Reported-by: Ilja Van Sprundel Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe --- drivers/infiniband/hw/qib/qib_user_sdma.c | 33 +++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c index deef6ff..0dc15f9 100644 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c @@ -607,7 +607,7 @@ static int qib_user_sdma_coalesce(const struct qib_devdata *dd, /* * How many pages in this iovec element? */ -static int qib_user_sdma_num_pages(const struct iovec *iov) +static size_t qib_user_sdma_num_pages(const struct iovec *iov) { const unsigned long addr = (unsigned long) iov->iov_base; const unsigned long len = iov->iov_len; @@ -663,7 +663,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, struct qib_user_sdma_queue *pq, struct qib_user_sdma_pkt *pkt, - unsigned long addr, int tlen, int npages) + unsigned long addr, int tlen, size_t npages) { struct page *pages[8]; int i, j; @@ -727,7 +727,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, unsigned long idx; for (idx = 0; idx < niov; idx++) { - const int npages = qib_user_sdma_num_pages(iov + idx); + const size_t npages = qib_user_sdma_num_pages(iov + idx); const unsigned long addr = (unsigned long) iov[idx].iov_base; ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr, @@ -829,8 +829,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, unsigned pktnw; unsigned pktnwc; int nfrags = 0; - int npages = 0; - int bytes_togo = 0; + size_t npages = 0; + size_t bytes_togo = 0; int tiddma = 0; int cfur; @@ -890,7 +890,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, npages += qib_user_sdma_num_pages(&iov[idx]); - bytes_togo += slen; + if (check_add_overflow(bytes_togo, slen, &bytes_togo) || + bytes_togo > type_max(typeof(pkt->bytes_togo))) { + ret = -EINVAL; + goto free_pbc; + } pktnwc += slen >> 2; idx++; nfrags++; @@ -909,8 +913,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, } if (frag_size) { - int tidsmsize, n; - size_t pktsize; + size_t tidsmsize, n, pktsize, sz, addrlimit; n = npages*((2*PAGE_SIZE/frag_size)+1); pktsize = struct_size(pkt, addr, n); @@ -928,14 +931,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, else tidsmsize = 0; - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL); + if (check_add_overflow(pktsize, tidsmsize, &sz)) { + ret = -EINVAL; + goto free_pbc; + } + pkt = kmalloc(sz, GFP_KERNEL); if (!pkt) { ret = -ENOMEM; goto free_pbc; } pkt->largepkt = 1; pkt->frag_size = frag_size; - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr); + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr), + &addrlimit) || + addrlimit > type_max(typeof(pkt->addrlimit))) { + ret = -EINVAL; + goto free_pbc; + } + pkt->addrlimit = addrlimit; if (tiddma) { char *tidsm = (char *)pkt + pktsize;