linux-rdma.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2 0/2] Fix an mmap exploit and remove push in i40iw
@ 2020-11-25  0:56 Shiraz Saleem
  2020-11-25  0:56 ` [PATCH v2 1/2] RDMA/i40iw: Address an mmap handler exploit " Shiraz Saleem
  2020-11-25  0:56 ` [PATCH v2 2/2] RDMA/i40iw: Remove push code from i40iw Shiraz Saleem
  0 siblings, 2 replies; 5+ messages in thread
From: Shiraz Saleem @ 2020-11-25  0:56 UTC (permalink / raw)
  To: dledford, jgg; +Cc: linux-rdma, stable, Shiraz Saleem

i40iw_mmap is vulnerable to an mmap exploit due to its manipulation on
vma->vm_pgoff done for the push feature, and its subsequent use in
remap_pfn_range without validation.

Patch #1 fixes the mmap exploit in i40iw_mmap and can be backported to stable if acceptable.

Patch #2 removes the push feature from the driver

v0-->v1:
* Add missing cc and reported by tags in Patch #1
v1-->v2:
* Fix compile issue in Patch #1

Shiraz Saleem (2):
  RDMA/i40iw: Address an mmap handler exploit in i40iw
  RDMA/i40iw: Remove push code from i40iw

 drivers/infiniband/hw/i40iw/i40iw.h        |    1 -
 drivers/infiniband/hw/i40iw/i40iw_ctrl.c   |   52 +------------
 drivers/infiniband/hw/i40iw/i40iw_d.h      |   35 +++-----
 drivers/infiniband/hw/i40iw/i40iw_main.c   |    5 -
 drivers/infiniband/hw/i40iw/i40iw_status.h |    1 -
 drivers/infiniband/hw/i40iw/i40iw_type.h   |   18 ----
 drivers/infiniband/hw/i40iw/i40iw_uk.c     |   41 +--------
 drivers/infiniband/hw/i40iw/i40iw_user.h   |    8 --
 drivers/infiniband/hw/i40iw/i40iw_verbs.c  |  123 ++--------------------------
 9 files changed, 25 insertions(+), 259 deletions(-)


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-12-02  0:51 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-11-25  0:56 [PATCH v2 0/2] Fix an mmap exploit and remove push in i40iw Shiraz Saleem
2020-11-25  0:56 ` [PATCH v2 1/2] RDMA/i40iw: Address an mmap handler exploit " Shiraz Saleem
2020-11-25 14:47   ` Jason Gunthorpe
2020-11-25  0:56 ` [PATCH v2 2/2] RDMA/i40iw: Remove push code from i40iw Shiraz Saleem
2020-12-02  0:50   ` Jason Gunthorpe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).