Merge "infiniband: CVE-2018-14734" into intel-4.9

2 files changed, 60 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
new file mode 100644
index 0000000..fb8cc06
--- /dev/null
+++ b/patches/cve/4.9.x.scc
@@ -0,0 +1,2 @@
+#CVEs fixed in 4.9.117:
+patch CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch
diff --git a/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch
new file mode 100644
index 0000000..4756a18
--- /dev/null
+++ b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch
@@ -0,0 +1,58 @@
+From cb2595c1393b4a5211534e6f0a0fbad369e21ad8 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Fri, 1 Jun 2018 11:31:44 -0700
+Subject: [PATCH] infiniband: fix a possible use-after-free bug
+
+ucma_process_join() will free the new allocated "mc" struct,
+if there is any error after that, especially the copy_to_user().
+
+But in parallel, ucma_leave_multicast() could find this "mc"
+through idr_find() before ucma_process_join() frees it, since it
+is already published.
+
+So "mc" could be used in ucma_leave_multicast() after it is been
+allocated and freed in ucma_process_join(), since we don't refcnt
+it.
+
+Fix this by separating "publish" from ID allocation, so that we
+can get an ID first and publish it later after copy_to_user().
+
+CVE: CVE-2018-14734   
+Upstream-Status: Backport  
+
+Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
+Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ drivers/infiniband/core/ucma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index eab43b1..ec8fb28 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx)
+                return NULL;
+ 
+        mutex_lock(&mut);
+-       mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
++       mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
+        mutex_unlock(&mut);
+        if (mc->id < 0)
+                goto error;
+@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct ucma_file *file,
+                goto err3;
+        }
+ 
++       mutex_lock(&mut);
++       idr_replace(&multicast_idr, mc, mc->id);
++       mutex_unlock(&mut);
++
+        mutex_unlock(&file->mut);
+        ucma_put_ctx(ctx);
+        return 0;
+-- 
+2.7.4
+