mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-02-05 00:45:28 +07:00
9d194d1025
In case of error while accessing to userspace memory, function
nes_create_qp() returns NULL instead of an error code wrapped through
ERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it
check for error with IS_ERR().
As page 0 is likely not mapped, it is going to trigger an Oops when
the kernel will try to dereference NULL pointer to access to struct
ib_qp's fields.
In some rare cases, page 0 could be mapped by userspace, which could
turn this bug to a vulnerability that could be exploited: the function
pointers in struct ib_device will be under userspace total control.
This was caught when using spatch (aka. coccinelle)
to rewrite calls to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null
Link:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| nes_cm.c | ||
| nes_cm.h | ||
| nes_context.h | ||
| nes_hw.c | ||
| nes_hw.h | ||
| nes_mgt.c | ||
| nes_mgt.h | ||
| nes_nic.c | ||
| nes_user.h | ||
| nes_utils.c | ||
| nes_verbs.c | ||
| nes_verbs.h | ||
| nes.c | ||
| nes.h | ||