From patchwork Wed May 18 16:46:11 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Doug Ledford X-Patchwork-Id: 9121331 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 244489F37F for ; Wed, 18 May 2016 16:46:48 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4F6FB2035E for ; Wed, 18 May 2016 16:46:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 35A252034E for ; Wed, 18 May 2016 16:46:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753742AbcERQqc (ORCPT ); Wed, 18 May 2016 12:46:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36137 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753738AbcERQqb (ORCPT ); Wed, 18 May 2016 12:46:31 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1FEF9C04B30B; Wed, 18 May 2016 16:46:31 +0000 (UTC) Received: from linux-ws.xsintricity.com.com (ovpn-116-52.rdu2.redhat.com [10.10.116.52]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u4IGkUkm004372; Wed, 18 May 2016 12:46:30 -0400 From: Doug Ledford To: stable@vger.kernel.org, linux-rdma@vger.kernel.org Cc: dledford@redhat.com Subject: [PATCH] IB/security: restrict use of the write() interface Date: Wed, 18 May 2016 12:46:11 -0400 Message-Id: <616598d79c0b8750d74e50cf22f8b61a9ef55c1d.1463589971.git.dledford@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 18 May 2016 16:46:31 +0000 (UTC) Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Upstream commit e6bd18f57aad (IB/security: Restrict use of the write() interface) handled the cases for all drivers in the current upstream kernel. The ipath driver had recently been deprecated and moved to staging, and then removed entirely. It had the same security flaw as the qib driver. Fix that up with this separate patch. Note: The ipath driver only supports hardware that ended production over 10 years ago, so there should be none of this hardware still present in the wild. Cc: stable@vger.kernel.org # 4.4.x Signed-off-by: Doug Ledford --- drivers/staging/rdma/ipath/ipath_file_ops.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/staging/rdma/ipath/ipath_file_ops.c b/drivers/staging/rdma/ipath/ipath_file_ops.c index 13c3cd11ab92..f237a2e2a086 100644 --- a/drivers/staging/rdma/ipath/ipath_file_ops.c +++ b/drivers/staging/rdma/ipath/ipath_file_ops.c @@ -45,6 +45,8 @@ #include #include +#include + #include "ipath_kernel.h" #include "ipath_common.h" #include "ipath_user_sdma.h" @@ -2243,6 +2245,9 @@ static ssize_t ipath_write(struct file *fp, const char __user *data, ssize_t ret = 0; void *dest; + if (WARN_ON_ONCE(!ib_safe_file_access(fp))) + return -EACCESS; + if (count < sizeof(cmd.type)) { ret = -EINVAL; goto bail;