linux/include/rdma
Jason Gunthorpe e6bd18f57a IB/security: Restrict use of the write() interface
The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
[ Expanded check to all known write() entry points ]
Cc: stable@vger.kernel.org
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-04-28 12:03:16 -04:00
..
ib.h IB/security: Restrict use of the write() interface 2016-04-28 12:03:16 -04:00
ib_addr.h net: rdma: use __ethtool_get_ksettings 2016-02-25 22:06:46 -05:00
ib_cache.h IB/core: Add gid_type to gid attribute 2015-12-23 10:35:10 -05:00
ib_cm.h IB/cm: Remove compare_data checks 2015-08-30 15:48:24 -04:00
ib_fmr_pool.h RDMA: Improve include file coding style 2008-07-14 23:48:44 -07:00
ib_mad.h IB/core: Documentation fix in the MAD header file 2016-03-03 13:13:52 -05:00
ib_marshall.h RDMA/cma: Export rdma cm interface to userspace 2006-12-12 11:50:22 -08:00
ib_pack.h IB/mlx4: Enable send of RoCE QP1 packets with IP/UDP headers 2016-01-19 15:35:01 -05:00
ib_pma.h IB/core: Display extended counter set if available 2015-12-23 15:58:30 -05:00
ib_sa.h IB/cma: Join and leave multicast groups with IGMP 2015-12-23 10:39:53 -05:00
ib_smi.h IB/core: Move SM class defines from ib_mad.h to ib_smi.h 2015-09-03 15:50:32 -04:00
ib_umem.h IB/core: Add support for on demand paging regions 2014-12-15 18:13:36 -08:00
ib_umem_odp.h IB/core: Implement support for MMU notifiers regarding on demand paging regions 2014-12-15 18:13:36 -08:00
ib_verbs.h Merge branches 'i40iw', 'sriov' and 'hfi1' into k.o/for-4.6 2016-03-21 17:32:23 -04:00
iw_cm.h iwcm: common code for port mapper 2016-03-16 13:47:52 -04:00
iw_portmap.h RDMA/core: Enable the iWarp Port Mapper to provide the actual address of the connecting peer to its clients 2015-05-05 09:18:01 -04:00
opa_port_info.h staging/rdma/hfi1, IB/core: Fix LinkDownReason define for consistency 2016-03-10 20:37:59 -05:00
opa_smi.h IB/core: Add core header changes needed for OPA 2015-08-28 22:54:50 -04:00
rdma_cm.h IB/core, cma: Make __attribute_const__ declarations sparse-friendly 2015-10-30 17:57:49 -04:00
rdma_cm_ib.h RDMA: Fix license text 2008-07-14 23:48:43 -07:00
rdma_netlink.h IB/core: Add rdma netlink helper functions 2015-08-30 18:12:25 -04:00
rdma_vt.h IB/rdmavt: Remove unnecessary exported functions 2016-03-10 20:38:10 -05:00
rdmavt_cq.h IB/rdmavt: Add completion queue functions 2016-03-10 20:37:24 -05:00
rdmavt_mr.h IB/rdmavt: Fix copyright date 2016-03-10 20:37:27 -05:00
rdmavt_qp.h IB/hfi1: Report pid in qp_stats to aid debug 2016-03-17 15:55:19 -04:00