diff options
Diffstat (limited to 'patches/cve')
-rw-r--r-- | patches/cve/4.9.x.scc | 2 | ||||
-rw-r--r-- | patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch | 58 |
2 files changed, 60 insertions, 0 deletions
diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc new file mode 100644 index 0000000..fb8cc06 --- /dev/null +++ b/patches/cve/4.9.x.scc | |||
@@ -0,0 +1,2 @@ | |||
1 | #CVEs fixed in 4.9.117: | ||
2 | patch CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch | ||
diff --git a/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch new file mode 100644 index 0000000..4756a18 --- /dev/null +++ b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch | |||
@@ -0,0 +1,58 @@ | |||
1 | From cb2595c1393b4a5211534e6f0a0fbad369e21ad8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Cong Wang <xiyou.wangcong@gmail.com> | ||
3 | Date: Fri, 1 Jun 2018 11:31:44 -0700 | ||
4 | Subject: [PATCH] infiniband: fix a possible use-after-free bug | ||
5 | |||
6 | ucma_process_join() will free the new allocated "mc" struct, | ||
7 | if there is any error after that, especially the copy_to_user(). | ||
8 | |||
9 | But in parallel, ucma_leave_multicast() could find this "mc" | ||
10 | through idr_find() before ucma_process_join() frees it, since it | ||
11 | is already published. | ||
12 | |||
13 | So "mc" could be used in ucma_leave_multicast() after it is been | ||
14 | allocated and freed in ucma_process_join(), since we don't refcnt | ||
15 | it. | ||
16 | |||
17 | Fix this by separating "publish" from ID allocation, so that we | ||
18 | can get an ID first and publish it later after copy_to_user(). | ||
19 | |||
20 | CVE: CVE-2018-14734 | ||
21 | Upstream-Status: Backport | ||
22 | |||
23 | Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") | ||
24 | Reported-by: Noam Rathaus <noamr@beyondsecurity.com> | ||
25 | Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> | ||
26 | Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> | ||
27 | Signed-off-by: Andreas Wellving <andreas.wellving@enea.com> | ||
28 | --- | ||
29 | drivers/infiniband/core/ucma.c | 6 +++++- | ||
30 | 1 file changed, 5 insertions(+), 1 deletion(-) | ||
31 | |||
32 | diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c | ||
33 | index eab43b1..ec8fb28 100644 | ||
34 | --- a/drivers/infiniband/core/ucma.c | ||
35 | +++ b/drivers/infiniband/core/ucma.c | ||
36 | @@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) | ||
37 | return NULL; | ||
38 | |||
39 | mutex_lock(&mut); | ||
40 | - mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); | ||
41 | + mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); | ||
42 | mutex_unlock(&mut); | ||
43 | if (mc->id < 0) | ||
44 | goto error; | ||
45 | @@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, | ||
46 | goto err3; | ||
47 | } | ||
48 | |||
49 | + mutex_lock(&mut); | ||
50 | + idr_replace(&multicast_idr, mc, mc->id); | ||
51 | + mutex_unlock(&mut); | ||
52 | + | ||
53 | mutex_unlock(&file->mut); | ||
54 | ucma_put_ctx(ctx); | ||
55 | return 0; | ||
56 | -- | ||
57 | 2.7.4 | ||
58 | |||