oss-sec mailing list archives
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access
From: Shachar Raindel <raindel () mellanox com>
Date: Thu, 2 Apr 2015 16:34:05 +0000
Hi,
-----Original Message----- From: Yann Droneaud [mailto:ydroneaud () opteya com] Sent: Thursday, April 02, 2015 6:16 PM To: Shachar Raindel Cc: oss-security () lists openwall com; <linux-rdma () vger kernel org> (linux-rdma () vger kernel org); linux-kernel () vger kernel org; stable () vger kernel org Subject: Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Hi, Le jeudi 02 avril 2015 à 10:52 +0000, Shachar Raindel a écrit :-----Original Message----- From: Yann Droneaud [mailto:ydroneaud () opteya com] Sent: Thursday, April 02, 2015 1:05 PM Le mercredi 18 mars 2015 à 17:39 +0000, Shachar Raindel a écrit :...+ /* + * If the combination of the addr and size requested for thismemory+ * region causes an integer overflow, return error. + */ + if ((PAGE_ALIGN(addr + size) <= size) || + (PAGE_ALIGN(addr + size) <= addr)) + return ERR_PTR(-EINVAL); +Can access_ok() be used here ? if (!access_ok(writable ? VERIFY_WRITE : VERIFY_READ, addr, size)) return ERR_PTR(-EINVAL);No, this will break the current ODP semantics. ODP allows the user to register memory that is not accessible yet. This is a critical design feature, as it allows avoiding holding a registration cache. Adding this check will break the behavior, forcing memory to be all accessible when registering an ODP MR.Failed to notice previously, but since this would break ODP, and ODP is only available starting v3.19-rc1, my proposed fix might be applicable for older kernel (if not better).
Can you explain how this proposed fix is better than the existing patch? Why do we want to push to the stable tree a patch that is not in the upstream? There is an existing, tested, patch that is going to the tip of the development. It even applies cleanly on every kernel version around. Thanks, --Shachar
Current thread:
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access, (continued)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Shachar Raindel (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Haggai Eran (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Shachar Raindel (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Haggai Eran (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Solar Designer (Apr 02)
- RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Shachar Raindel (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 02)
- RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Shachar Raindel (Apr 02)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 08)
- Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Yann Droneaud (Apr 08)