From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:43023 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752769AbcHNPnD (ORCPT ); Sun, 14 Aug 2016 11:43:03 -0400 Subject: Patch "IB/security: Restrict use of the write() interface" has been added to the 3.14-stable tree To: ben@decadent.org.uk, dledford@redhat.com, gregkh@linuxfoundation.org, jgunthorpe@obsidianresearch.com Cc: , From: Date: Sun, 14 Aug 2016 17:43:02 +0200 In-Reply-To: <20160531024050.GL7555@decadent.org.uk> Message-ID: <1471189382109113@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled IB/security: Restrict use of the write() interface to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ib-security-restrict-use-of-the-write-interface.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From ben@decadent.org.uk Sun Aug 14 17:34:33 2016 From: Ben Hutchings Date: Tue, 31 May 2016 03:40:50 +0100 Subject: IB/security: Restrict use of the write() interface To: stable@vger.kernel.org Cc: Jason Gunthorpe , Doug Ledford , linux-rdma@vger.kernel.org Message-ID: <20160531024050.GL7555@decadent.org.uk> Content-Disposition: inline From: Ben Hutchings Commit e6bd18f57aad ("IB/security: Restrict use of the write() interface") fixed a security problem with various write() implementations in the Infiniband subsystem. In older kernel versions the ipath_write() function has the same problem and needs the same restriction. (The ipath driver has been completely removed upstream.) Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/ipath/ipath_file_ops.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/infiniband/hw/ipath/ipath_file_ops.c +++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c @@ -45,6 +45,8 @@ #include #include +#include + #include "ipath_kernel.h" #include "ipath_common.h" #include "ipath_user_sdma.h" @@ -2240,6 +2242,9 @@ static ssize_t ipath_write(struct file * ssize_t ret = 0; void *dest; + if (WARN_ON_ONCE(!ib_safe_file_access(fp))) + return -EACCES; + if (count < sizeof(cmd.type)) { ret = -EINVAL; goto bail; Patches currently in stable-queue which might be from ben@decadent.org.uk are queue-3.14/sctp-prevent-soft-lockup-when-sctp_accept-is-called-during-a-timeout-event.patch queue-3.14/ib-security-restrict-use-of-the-write-interface.patch queue-3.14/usb-quirk-fix.patch