31 lines
1.3 KiB
Diff
31 lines
1.3 KiB
Diff
From 6dd2d4ad9c8429523b1c220c5132bd551c006425 Mon Sep 17 00:00:00 2001
|
|
From: Jason Gunthorpe <jgg@nvidia.com>
|
|
Date: Tue, 28 Apr 2026 13:17:37 -0300
|
|
Subject: [PATCH] RDMA/mana: Validate rx_hash_key_len
|
|
|
|
Sashiko points out that rx_hash_key_len comes from a uAPI structure and is
|
|
blindly passed to memcpy, allowing the userspace to trash kernel
|
|
memory. Bounds check it so the memcpy cannot overflow.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
|
|
Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1
|
|
Link: https://patch.msgid.link/r/4-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com
|
|
Reviewed-by: Long Li <longli@microsoft.com>
|
|
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
|
|
|
|
diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
|
|
index 48c1f49..8eb956e 100644
|
|
--- a/drivers/infiniband/hw/mana/qp.c
|
|
+++ b/drivers/infiniband/hw/mana/qp.c
|
|
@@ -21,6 +21,9 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
|
|
|
|
gc = mdev_to_gc(dev);
|
|
|
|
+ if (rx_hash_key_len > sizeof(req->hashkey))
|
|
+ return -EINVAL;
|
|
+
|
|
req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_DEF_SIZE);
|
|
req = kzalloc(req_buf_size, GFP_KERNEL);
|
|
if (!req)
|