OSDN Git Service

RDMA/ucma: Limit possible option size
authorLeon Romanovsky <leonro@mellanox.com>
Wed, 7 Mar 2018 12:49:09 +0000 (14:49 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 18 Mar 2018 10:17:48 +0000 (11:17 +0100)
commit42228fa0804a3a01612e855e8b123bae1a06a1e3
tree1bdc398c119bf99b300374e1f36c7c57aaad124f
parent8b5ab55d254f36e89b1b53aeac7223d2d102483e
RDMA/ucma: Limit possible option size

commit 6a21dfc0d0db7b7e0acedce67ca533a6eb19283c upstream.

Users of ucma are supposed to provide size of option level,
in most paths it is supposed to be equal to u8 or u16, but
it is not the case for the IB path record, where it can be
multiple of struct ib_path_rec_data.

This patch takes simplest possible approach and prevents providing
values more than possible to allocate.

Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
Fixes: 7ce86409adcd ("RDMA/ucma: Allow user space to set service type")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/core/ucma.c