From patchwork Tue May 24 17:54:31 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 625831 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3rDjmC3g0kz9snk; Wed, 25 May 2016 03:57:15 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1b5GZs-0002Uu-HK; Tue, 24 May 2016 17:57:12 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1b5GYH-00018g-0C for kernel-team@lists.ubuntu.com; Tue, 24 May 2016 17:55:33 +0000 Received: from 1.general.kamal.us.vpn ([10.172.68.52] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1b5GYG-0006LZ-9k; Tue, 24 May 2016 17:55:32 +0000 Received: from kamal by fourier with local (Exim 4.86_2) (envelope-from ) id 1b5GYD-00010d-KW; Tue, 24 May 2016 10:55:29 -0700 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Subject: [PATCH 4.2.y-ckt 01/53] [4.2-stable only] fix backport "IB/security: restrict use of the write() interface" Date: Tue, 24 May 2016 10:54:31 -0700 Message-Id: <1464112523-3701-2-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1464112523-3701-1-git-send-email-kamal@canonical.com> References: <1464112523-3701-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 4.2 Cc: Doug Ledford , Kamal Mostafa X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com 4.2.8-ckt11 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Doug Ledford Upstream commit e6bd18f57aad (IB/security: Restrict use of the write() interface) handled the cases for all drivers in the current upstream kernel. The ipath driver had recently been deprecated and moved to staging, and then removed entirely. It had the same security flaw as the qib driver. Fix that up with this separate patch. Note: The ipath driver only supports hardware that ended production over 10 years ago, so there should be none of this hardware still present in the wild. Signed-off-by: Doug Ledford Signed-off-by: Kamal Mostafa --- drivers/infiniband/hw/ipath/ipath_file_ops.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c index 450d159..f63ad70 100644 --- a/drivers/infiniband/hw/ipath/ipath_file_ops.c +++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c @@ -45,6 +45,8 @@ #include #include +#include + #include "ipath_kernel.h" #include "ipath_common.h" #include "ipath_user_sdma.h" @@ -2244,6 +2246,9 @@ static ssize_t ipath_write(struct file *fp, const char __user *data, ssize_t ret = 0; void *dest; + if (WARN_ON_ONCE(!ib_safe_file_access(fp))) + return -EACCES; + if (count < sizeof(cmd.type)) { ret = -EINVAL; goto bail;