diff options
| author |   Bart Van Assche <bart.vanassche@wdc.com> | 2018-03-01 14:00:30 -0800 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2018-03-06 16:00:51 -0700 |
| commit | 2a78cb4db487372152bed2055c038f9634d595e8 (patch) | |
| tree | 6731211a2841315ef65ae6f0e10d75fed8c487f7 /drivers/infiniband/hw/i40iw | |
| parent | RDMA/rxe: Fix an out-of-bounds read (diff) | |
| download | linux-dev-2a78cb4db487372152bed2055c038f9634d595e8.tar.xz linux-dev-2a78cb4db487372152bed2055c038f9634d595e8.zip | |
IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()
Avoid triggering an out-of-bounds stack access by changing the type
of 'wr' from ib_send_wr into ib_rdma_wr.
This patch fixes the following KASAN bug report:
BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
Read of size 8 at addr ffff880068197a48 by task kworker/2:1/44
Workqueue: ib_cm cm_work_handler [ib_cm]
Call Trace:
dump_stack+0x8e/0xcd
print_address_description+0x6f/0x280
kasan_report+0x25a/0x380
__asan_load8+0x54/0x90
rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
srpt_zerolength_write+0xf0/0x180 [ib_srpt]
srpt_cm_rtu_recv+0x68/0x110 [ib_srpt]
srpt_rdma_cm_handler+0xbb/0x15b [ib_srpt]
cma_ib_handler+0x1aa/0x4a0 [rdma_cm]
cm_process_work+0x30/0x100 [ib_cm]
cm_work_handler+0xa86/0x351b [ib_cm]
process_one_work+0x475/0x9f0
worker_thread+0x69/0x690
kthread+0x1ad/0x1d0
ret_from_fork+0x3a/0x50
Fixes: aaf45bd83eba ("IB/srpt: Detect session shutdown reliably")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/i40iw')
0 files changed, 0 insertions, 0 deletions