linux-kernel - [PATCH 4.6 010/203] IB/core: Fix bit curruption in ib_device_cap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 25 Jul 2016 13:53:45 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	linux-kernel@...r.kernel.org
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	stable@...r.kernel.org, Robert LeBlanc <robert@...lancnet.us>,
	Sagi Grimberg <sagi@...mberg.me>,
	Max Gurtovoy <maxg@...lanox.com>,
	Matan Barak <matanb@...lanox.com>,
	Christoph Hellwig <hch@....de>,
	Doug Ledford <dledford@...hat.com>
Subject: [PATCH 4.6 010/203] IB/core: Fix bit curruption in ib_device_cap_flags structure

4.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Max Gurtovoy <maxg@...lanox.com>

commit 47355b3cd7d3c9c5226bff7c449b9d269fb17fa6 upstream.

ib_device_cap_flags 64-bit expansion caused caps overlapping
and made consumers read wrong device capabilities. For example
IB_DEVICE_SG_GAPS_REG was falsely read by the iser driver causing
it to use a non-existing capability. This happened because signed
int becomes sign extended when converted it to u64. Fix this by
casting IB_DEVICE_ON_DEMAND_PAGING enumeration to ULL.

Fixes: f5aa9159a418 ('IB/core: Add arbitrary sg_list support')
Reported-by: Robert LeBlanc <robert@...lancnet.us>
Acked-by: Sagi Grimberg <sagi@...mberg.me>
Signed-off-by: Max Gurtovoy <maxg@...lanox.com>
Signed-off-by: Matan Barak <matanb@...lanox.com>
Reviewed-by: Christoph Hellwig <hch@....de>
Signed-off-by: Doug Ledford <dledford@...hat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 include/rdma/ib_verbs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -217,7 +217,7 @@ enum ib_device_cap_flags {
 	IB_DEVICE_CROSS_CHANNEL		= (1 << 27),
 	IB_DEVICE_MANAGED_FLOW_STEERING		= (1 << 29),
 	IB_DEVICE_SIGNATURE_HANDOVER		= (1 << 30),
-	IB_DEVICE_ON_DEMAND_PAGING		= (1 << 31),
+	IB_DEVICE_ON_DEMAND_PAGING		= (1ULL << 31),
 	IB_DEVICE_SG_GAPS_REG			= (1ULL << 32),
 	IB_DEVICE_VIRTUAL_FUNCTION		= ((u64)1 << 33),
 };