kernel/IB: IB-CVE-2016-4565dizzy-enea

Unprivileged process can overwrite kernel memory using rdma_ucm.ko

References:
===========
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4565
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4565

Reference to the upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/
commit/?id=5d43a619be6f1960702daafafe87ceab415be6bc

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Tudor Florea <tudor.florea@enea.com>

3 files changed, 162 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch b/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch
new file mode 100644
index 0000000..0bd6d5c
--- /dev/null
+++ b/recipes-kernel/linux/linux-hierofalcon/IB-CVE-2016-4565.patch
@@ -0,0 +1,160 @@
+From 5d43a619be6f1960702daafafe87ceab415be6bc Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Date: Sun, 10 Apr 2016 19:13:13 -0600
+Subject: IB/security: Restrict use of the write() interface
+
+[ Upstream commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 ]
+
+The drivers/infiniband stack uses write() as a replacement for
+bi-directional ioctl().  This is not safe. There are ways to
+trigger write calls that result in the return structure that
+is normally written to user space being shunted off to user
+specified kernel memory instead.
+
+For the immediate repair, detect and deny suspicious accesses to
+the write API.
+
+For long term, update the user space libraries and the kernel API
+to something that doesn't present the same security vulnerabilities
+(likely a structured ioctl() interface).
+
+The impacted uAPI interfaces are generally only available if
+hardware from drivers/infiniband is installed in the system.
+
+CVE: CVE-2016-4565
+Upstream-Status: Backport
+
+Reported-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+[ Expanded check to all known write() entry points ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/infiniband/core/ucm.c            |  4 ++++
+ drivers/infiniband/core/ucma.c           |  3 +++
+ drivers/infiniband/core/uverbs_main.c    |  5 +++++
+ drivers/infiniband/hw/qib/qib_file_ops.c |  5 +++++
+ include/rdma/ib.h                        | 16 ++++++++++++++++
+ 5 files changed, 33 insertions(+)
+
+diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
+index f2f6393..5befec1 100644
+--- a/drivers/infiniband/core/ucm.c
++++ b/drivers/infiniband/core/ucm.c
+@@ -48,6 +48,7 @@
+ 
+ #include <asm/uaccess.h>
+ 
++#include <rdma/ib.h>
+ #include <rdma/ib_cm.h>
+ #include <rdma/ib_user_cm.h>
+ #include <rdma/ib_marshall.h>
+@@ -1104,6 +1105,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
+        struct ib_ucm_cmd_hdr hdr;
+        ssize_t result;
+ 
++       if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++               return -EACCES;
++
+        if (len < sizeof(hdr))
+                return -EINVAL;
+ 
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 45d67e9..81dd84d 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1487,6 +1487,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
+        struct rdma_ucm_cmd_hdr hdr;
+        ssize_t ret;
+ 
++       if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++               return -EACCES;
++
+        if (len < sizeof(hdr))
+                return -EINVAL;
+ 
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 09686d4..e063b07 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -48,6 +48,8 @@
+ 
+ #include <asm/uaccess.h>
+ 
++#include <rdma/ib.h>
++
+ #include "uverbs.h"
+ 
+ MODULE_AUTHOR("Roland Dreier");
+@@ -613,6 +615,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+        struct ib_uverbs_cmd_hdr hdr;
+        __u32 flags;
+ 
++       if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++               return -EACCES;
++
+        if (count < sizeof hdr)
+                return -EINVAL;
+ 
+diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
+index 7258818..619154e 100644
+--- a/drivers/infiniband/hw/qib/qib_file_ops.c
++++ b/drivers/infiniband/hw/qib/qib_file_ops.c
+@@ -45,6 +45,8 @@
+ #include <linux/export.h>
+ #include <linux/uio.h>
+ 
++#include <rdma/ib.h>
++
+ #include "qib.h"
+ #include "qib_common.h"
+ #include "qib_user_sdma.h"
+@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data,
+        ssize_t ret = 0;
+        void *dest;
+ 
++       if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
++               return -EACCES;
++
+        if (count < sizeof(cmd.type)) {
+                ret = -EINVAL;
+                goto bail;
+diff --git a/include/rdma/ib.h b/include/rdma/ib.h
+index cf8f9e7..a6b9370 100644
+--- a/include/rdma/ib.h
++++ b/include/rdma/ib.h
+@@ -34,6 +34,7 @@
+ #define _RDMA_IB_H
+ 
+ #include <linux/types.h>
++#include <linux/sched.h>
+ 
+ struct ib_addr {
+        union {
+@@ -86,4 +87,19 @@ struct sockaddr_ib {
+        __u64                   sib_scope_id;
+ };
+ 
++/*
++ * The IB interfaces that use write() as bi-directional ioctl() are
++ * fundamentally unsafe, since there are lots of ways to trigger "write()"
++ * calls from various contexts with elevated privileges. That includes the
++ * traditional suid executable error message writes, but also various kernel
++ * interfaces that can write to file descriptors.
++ *
++ * This function provides protection for the legacy API by restricting the
++ * calling context.
++ */
++static inline bool ib_safe_file_access(struct file *filp)
++{
++       return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS);
++}
++
+ #endif /* _RDMA_IB_H */
+-- 
+cgit v0.12
+
diff --git a/recipes-kernel/linux/linux-hierofalcon_3.19.bb b/recipes-kernel/linux/linux-hierofalcon_3.19.bb
index 5c24d8e..7b40313 100644
--- a/recipes-kernel/linux/linux-hierofalcon_3.19.bb
+++ b/recipes-kernel/linux/linux-hierofalcon_3.19.bb
@@ -38,6 +38,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-3.19;branch="standard/qemuarm6
            file://Btrfs-CVE-2015-8374.patch \
            file://ALSA-CVE-2016-2384.patch \
            file://net-ppp-CVE-2015-8569.patch \
+           file://IB-CVE-2016-4565.patch \
            "
 
 S = "${WORKDIR}/git"
diff --git a/recipes-kernel/linux/linux-hierofalcon_4.1.bb b/recipes-kernel/linux/linux-hierofalcon_4.1.bb
index 9a0f2d7..a55415c 100644
--- a/recipes-kernel/linux/linux-hierofalcon_4.1.bb
+++ b/recipes-kernel/linux/linux-hierofalcon_4.1.bb
@@ -39,6 +39,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-4.1;branch="standard/qemuarm64
            file://Btrfs-CVE-2015-8374.patch \
            file://ALSA-CVE-2016-2384.patch \
            file://net-ppp-CVE-2015-8569.patch \
+           file://IB-CVE-2016-4565.patch \
            "
 
 S = "${WORKDIR}/git"