From patchwork Tue Jul 31 13:02:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 143188 Delivered-To: patch@linaro.org Received: by 2002:a2e:9754:0:0:0:0:0 with SMTP id f20-v6csp5305971ljj; Tue, 31 Jul 2018 06:02:45 -0700 (PDT) X-Google-Smtp-Source: AAOMgpcOa8n4L7Yro2y6MKF52ICz8lIgDuv6P1ijkmOqmR51uefRaJh56VT8X4dwT+kF+mocCreC X-Received: by 2002:a63:62c4:: with SMTP id w187-v6mr20249942pgb.55.1533042164955; Tue, 31 Jul 2018 06:02:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1533042164; cv=none; d=google.com; s=arc-20160816; b=NWbYlq0Wz3kejAap/ENILj90r62cmlFOOZ7ViAbDfIZ2RUG8qmz4ckem4xGZimHC/8 zP8zUfQSJ/NT9NSA3D9s7S0P86XEPQgVab8inofCL7JQ7yi93EaqSpA9PN0SqBeQAkK+ OVk8F/YXwVNo6e5o/RRkAgVWp9xBkaD/ffkO6L0XHJf66OS2JbMPodsEl1SMAC0BVVuP hKLKCc4yU53hZGaHRl/p/TC7tHOyaR2qRDEPcQmxl6CSIbhinP3wjb49BS225Vw1osa6 1tM1qv4cy0jyjzyHYMQBOC0+d06IGVj/gXBh3DLwSsO8DIbYUBxzodwIwDistwZ1KbR5 q2hg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=wGKjaKBHDVOJMKcf7qurGpng/ABlnYk8rNAYdyGmX1Y=; b=xytC6Qg82yo432kV08WnPs8rSv0xW5HIaTfMG0LjszvbUd72ADNpJLgEWzJTyGF6pe ekkNQHZtXoD2D8KVMCTYCURZfekSjgh1ETyFko/22wmETPSozACuRWyv15koN694kFB+ wpxHWQreWuJHjJZFZkN4efovbhR7YNsuJgqPHHSz3MCnm/yYFW/D67ppks78Qzc5Qysa nYFmDDvgOkbHKOuttUZyYtlPdDOH65f+Oc4hDryX0Ho3MsKbAWN0V4bhM/YmxrzpVCzn Sr5PFQrkO/PLgbUFG42fvqelTsySZ8F7VWO2peJGNMVWE8pAOcSDkSoemnLvg78lcAJm MR/w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=FaiXHovc; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u35-v6si13052722pgl.237.2018.07.31.06.02.44; Tue, 31 Jul 2018 06:02:44 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=FaiXHovc; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732242AbeGaOm5 (ORCPT + 13 others); Tue, 31 Jul 2018 10:42:57 -0400 Received: from mail-pf1-f196.google.com ([209.85.210.196]:34184 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732141AbeGaOm5 (ORCPT ); Tue, 31 Jul 2018 10:42:57 -0400 Received: by mail-pf1-f196.google.com with SMTP id k19-v6so6080869pfi.1 for ; Tue, 31 Jul 2018 06:02:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=wGKjaKBHDVOJMKcf7qurGpng/ABlnYk8rNAYdyGmX1Y=; b=FaiXHovcsZhzrrZg9iiounZCUlaFtiAxPkl8mKLoXgQ8/fZvf7Qb9uUjuyqwDw+FwF zASsL19E7InsJZJzbyr4SrAYScn+utc8PDCwkLNf9tBo4DOxlG3kx9AnKqNvB7Jc+tuY r8veTnWuqWpYgHiMqItfkDdyQUzEdHNqwO7Pc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=wGKjaKBHDVOJMKcf7qurGpng/ABlnYk8rNAYdyGmX1Y=; b=oVVIHoSlBkHp3dt/syYT51PkJQYflb/Sf4mjvvcb1S1n2sQAVdKTDh5URXfr6y0lHS GaxAVA9tiKIcYfrXG5VVSvgrSbkx/QuD/a3KMWhlNKDiosKzZXMW0Dsob6gP+oc5PHht rxnY08+QC2vzcZeenjzQXAkQ9SdYYBkevscA0eSr+sp7/oIK9pkOiKKaED7zTHdulfkY eZrgSeEe1vmTVkTkNjCGGA1eVBIcEUcjq0pJzjT4r6x/ts5Jx2Q+x8totJuJETtJhzvF Ywr0jDaeabO+D0oIMxMsx1dXhd1CtjGImHSo33WyV5oj+gFZVpPLE5+GyB+VaSSqnIOO ONdw== X-Gm-Message-State: AOUpUlHIjwj7OQO1plhfJoKZvO1Sq5uPYFtLYYK4r8cflkZkyuD0vB+8 gMjAkHcQI1wXy0N8ols7Jt4k+qljdtg= X-Received: by 2002:a62:f909:: with SMTP id o9-v6mr22281033pfh.141.1533042162971; Tue, 31 Jul 2018 06:02:42 -0700 (PDT) Received: from localhost.localdomain ([106.51.18.123]) by smtp.gmail.com with ESMTPSA id f23-v6sm23048473pgl.5.2018.07.31.06.02.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 31 Jul 2018 06:02:41 -0700 (PDT) From: Amit Pundir To: Greg KH , Stable Cc: Michael Mera , Doug Ledford Subject: [PATCH for-4.9.y] IB/ocrdma: fix out of bounds access to local buffer Date: Tue, 31 Jul 2018 18:32:22 +0530 Message-Id: <1533042142-8681-6-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1533042142-8681-1-git-send-email-amit.pundir@linaro.org> References: <1533042142-8681-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Mera commit 062d0f22a30c39840ea49b72cfcfc1aa4cc538fa upstream. In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is written at index 'count-1' where 'count' is the size of the write, so potentially 0. This patch filters odd values for the write size/position to avoid this type of problem. Signed-off-by: Michael Mera Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford Signed-off-by: Amit Pundir --- Please cherry-pick it on 4.4.y as well. Not applicable for 3.18.y drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.7.4 diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c index 265943069b35..84349d976162 100644 --- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c @@ -645,7 +645,7 @@ static ssize_t ocrdma_dbgfs_ops_write(struct file *filp, struct ocrdma_stats *pstats = filp->private_data; struct ocrdma_dev *dev = pstats->dev; - if (count > 32) + if (*ppos != 0 || count == 0 || count > sizeof(tmp_str)) goto err; if (copy_from_user(tmp_str, buffer, count))