github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-20 01:20:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
8aa807a89d
linux/drivers/infiniband/core
History
Jason Gunthorpe 7122ff9606 RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() 
Sashiko points out the legacy write path in ib_uverbs_write() does
allocate a struct uverbs_attr_bundle, but it doesn't wrap it in a
bundle_priv so downcasting here isn't safe.

Instead lift the method_elm out of the bundle_priv and use it for the
debug function. The legacy write path will leave it set as NULL since the
write method_elm uses a different type.

Cc: stable@vger.kernel.org
Fixes: 1de9287ece ("RDMA: Add ib_copy_validate_udata_in()")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-05-19 19:32:48 -03:00
..
addr.c IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg() 2026-04-29 16:37:12 -03:00
agent.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
agent.h
cache.c RDMA/core: Fix memory free for GID table 2026-04-07 11:42:34 -03:00
cgroup.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
cm_msgs.h RDMA/core: Add necessary spaces 2021-04-12 14:52:22 -03:00
cm_trace.c RDMA/cm: Replace pr_debug() call sites with tracepoints 2020-08-24 19:41:41 -03:00
cm_trace.h IB/cm: Remove dead code and adjust naming 2025-05-25 06:24:21 -04:00
cm.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
cma_configfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cma_priv.h RDMA/core: introduce rdma_restrict_node_type() 2026-02-08 17:12:58 -06:00
cma_trace.c RDMA/cma: Add trace points in RDMA Connection Manager 2020-01-07 16:10:53 -04:00
cma_trace.h IB/cm: Remove dead code and adjust naming 2025-05-25 06:24:21 -04:00
cma.c RDMA/core: Check id_priv->restricted_node_type in cma_listen_on_dev() 2026-02-25 07:50:10 -05:00
core_priv.h RDMA/core: Fix stale RoCE GIDs during netdev events at registration 2026-02-24 03:43:16 -05:00
counters.c RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters 2025-07-02 05:11:44 -04:00
cq.c RDMA/core: Reject zero CQE count 2026-02-25 08:15:30 -05:00
device.c RDMA v7.1 merge window 2026-04-20 11:20:35 -07:00
frmr_pools.c RDMA/core: Add netlink command to modify FRMR aging 2026-03-02 13:45:37 -05:00
frmr_pools.h RDMA/core: Add netlink command to modify FRMR aging 2026-03-02 13:45:37 -05:00
ib_core_uverbs.c RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() 2026-05-19 19:32:48 -03:00
iter.c RDMA: Move DMA block iterator logic into dedicated files 2026-02-25 08:15:30 -05:00
iwcm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iwcm.h RDMA/iwcm: Fix workqueue list corruption by removing work_list 2026-01-15 04:59:53 -05:00
iwpm_msg.c RDMA/core: Prefer NLA_NUL_STRING 2026-04-09 10:58:56 -03:00
iwpm_util.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
iwpm_util.h RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
lag.c RDMA/core: Remove NULL check before dev_{put, hold} 2024-05-05 15:12:35 +03:00
mad_priv.h IB/mad: Add flow control for solicited MADs 2025-07-09 02:51:30 -04:00
mad_rmpp.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mad_rmpp.h
mad.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Makefile IB/core: Introduce FRMR pools 2026-03-02 13:44:58 -05:00
mr_pool.c Linux 5.2-rc6 2019-06-28 21:18:23 -03:00
multicast.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netlink.c RDMA/nldev: Add support for RDMA monitoring 2024-09-13 08:29:14 +03:00
nldev.c RDMA/nldev: Add mutual exclusion in nldev_dellink() 2026-05-13 14:17:16 -04:00
opa_smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
packer.c
rdma_core.c RDMA/uverbs: Update outdated reference to remove_commit_idr_uobject() 2026-03-30 13:47:44 -04:00
rdma_core.h RDMA: Add ib_copy_validate_udata_in() 2026-03-08 06:20:25 -04:00
restrack.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
restrack.h RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
roce_gid_mgmt.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
rw.c RDMA/rw: Fix MR pool exhaustion in bvec RDMA READ path 2026-03-17 15:00:56 -04:00
sa_query.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
sa.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
security.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smi.c RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
sysfs.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
trace.c RDMA/core: Clean up tracepoint headers 2020-07-06 14:54:46 -03:00
ucaps.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ucma.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ud_header.c RDMA/core: Remove unused ib_ud_header_unpack 2024-12-24 05:00:42 -05:00
umem_dmabuf.c RDMA v7.1 merge window 2026-04-20 11:20:35 -07:00
umem_odp.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
umem.c RDMA/umem: Use consistent DMA attributes when unmapping entries 2026-03-30 13:47:45 -04:00
user_mad.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
uverbs_cmd.c RDMA/core: Fix rereg_mr use-after-free race 2026-04-29 16:37:12 -03:00
uverbs_ioctl.c RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() 2026-05-19 19:32:48 -03:00
uverbs_main.c mm: rename zap_vma_ptes() to zap_special_vma_range() 2026-04-05 13:53:15 -07:00
uverbs_marshall.c RDMA/core: Remove unused ib_copy_path_rec_from_user 2024-12-24 05:00:42 -05:00
uverbs_std_types_async_fd.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_std_types_counters.c IB/uverbs: Fix an potential error pointer dereference 2023-08-07 16:49:59 +03:00
uverbs_std_types_cq.c RDMA/core: Fix user CQ creation for drivers without create_cq 2026-04-17 12:16:00 -03:00
uverbs_std_types_device.c RDMA: Add IB_UVERBS_CORE_SUPPORT_ROBUST_UDATA 2026-03-08 06:20:25 -04:00
uverbs_std_types_dm.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_dmabuf.c drm-misc-next for v7.1: 2026-03-02 16:58:07 +10:00
uverbs_std_types_dmah.c RDMA/core: Introduce a DMAH object and its alloc/free APIs 2025-07-23 01:42:10 -04:00
uverbs_std_types_flow_action.c RDMA/core: Delete IPsec flow action logic from the core 2022-04-09 08:25:06 +03:00
uverbs_std_types_mr.c IB: Extend UVERBS_METHOD_REG_MR to get DMAH 2025-07-23 01:42:11 -04:00
uverbs_std_types_qp.c RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create 2025-07-01 05:21:44 -04:00
uverbs_std_types_srq.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_wq.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_uapi.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
uverbs.h RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() 2026-05-19 19:32:48 -03:00
verbs.c RDMA/core: Remove unused ib_resize_cq() implementation 2026-03-30 13:47:43 -04:00