linux-kernel - Re: [PATCH] RDMA/ucma: check fd type in ucma_migrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180904212425.GD18686@ziepe.ca>
Date:   Tue, 4 Sep 2018 15:24:25 -0600
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Jann Horn <jannh@...gle.com>
Cc:     Doug Ledford <dledford@...hat.com>, linux-rdma@...r.kernel.org,
        Sean Hefty <sean.hefty@...el.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] RDMA/ucma: check fd type in ucma_migrate_id()

On Mon, Sep 03, 2018 at 06:54:14PM +0200, Jann Horn wrote:
> The current code grabs the private_data of whatever file descriptor
> userspace has supplied and implicitly casts it to a `struct ucma_file *`,
> potentially causing a type confusion.
> 
> This is probably fine in practice because the pointer is only used for
> comparisons, it is never actually dereferenced; and even in the
> comparisons, it is unlikely that a file from another filesystem would have
> a ->private_data pointer that happens to also be valid in this context.
> But ->private_data is not always guaranteed to be a valid pointer to an
> object owned by the file's filesystem; for example, some filesystems just
> cram numbers in there.
> 
> Check the type of the supplied file descriptor to be safe, analogous to how
> other places in the kernel do it.
> 
> Fixes: 88314e4dda1e ("RDMA/cma: add support for rdma_migrate_id()")
> Signed-off-by: Jann Horn <jannh@...gle.com>
> ---
> Only compile-tested, because I don't have an environment in which I
> could test this.
> 
>  drivers/infiniband/core/ucma.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Yep, this looks right to me also, applied to for-rc, thanks

Jason