IB/uverbs: Always use the attribute size provided by the user
authorMatan Barak <matanb@mellanox.com>
Tue, 13 Feb 2018 10:18:29 +0000 (12:18 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 15 Feb 2018 21:59:44 +0000 (14:59 -0700)
commit89d9e8d3f14d807bbd7725f8f6f5eeb7f6f5c42f
treeb57b20a7b70b6eaeef87f1c63f3a9aa3a0d92023
parent415bb699d793f7ad9c67c04a766d1e655fa6b203
IB/uverbs: Always use the attribute size provided by the user

This fixes several bugs around the copy_to/from user path:
 - copy_to used the user provided size of the attribute
   and could copy data beyond the end of the kernel buffer into
   userspace.
 - copy_from didn't know the size of the kernel buffer and
   could have left kernel memory unexpectedly un-initialized.
 - copy_from did not use the user length to determine if the
   attribute data is inlined or not.

Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/uverbs_std_types.c
include/rdma/uverbs_ioctl.h