From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:43222 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932166AbcHNQAM (ORCPT ); Sun, 14 Aug 2016 12:00:12 -0400 Subject: Patch "ipath: Restrict use of the write() interface" has been added to the 4.4-stable tree To: ben@decadent.org.uk, dledford@redhat.com, gregkh@linuxfoundation.org, jgunthorpe@obsidianresearch.com Cc: , From: Date: Sun, 14 Aug 2016 18:00:07 +0200 In-Reply-To: <20160531023356.GI7555@decadent.org.uk> Message-ID: <147119040756197@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ipath: Restrict use of the write() interface to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipath-restrict-use-of-the-write-interface.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From ben@decadent.org.uk Sun Aug 14 16:54:26 2016 From: Ben Hutchings Date: Tue, 31 May 2016 03:33:57 +0100 Subject: ipath: Restrict use of the write() interface To: stable@vger.kernel.org Cc: Jason Gunthorpe , Doug Ledford , linux-rdma@vger.kernel.org Message-ID: <20160531023356.GI7555@decadent.org.uk> Content-Disposition: inline From: Ben Hutchings Commit e6bd18f57aad ("IB/security: Restrict use of the write() interface") fixed a security problem with various write() implementations in the Infiniband subsystem. In older kernel versions the ipath_write() function has the same problem and needs the same restriction. (The ipath driver has been completely removed upstream.) Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rdma/ipath/ipath_file_ops.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/staging/rdma/ipath/ipath_file_ops.c +++ b/drivers/staging/rdma/ipath/ipath_file_ops.c @@ -45,6 +45,8 @@ #include #include +#include + #include "ipath_kernel.h" #include "ipath_common.h" #include "ipath_user_sdma.h" @@ -2243,6 +2245,9 @@ static ssize_t ipath_write(struct file * ssize_t ret = 0; void *dest; + if (WARN_ON_ONCE(!ib_safe_file_access(fp))) + return -EACCES; + if (count < sizeof(cmd.type)) { ret = -EINVAL; goto bail; Patches currently in stable-queue which might be from ben@decadent.org.uk are queue-4.4/ipath-restrict-use-of-the-write-interface.patch