• Leon Romanovsky's avatar
    RDMA/ucma: Limit possible option size · 6a21dfc0
    Leon Romanovsky authored
    Users of ucma are supposed to provide size of option level,
    in most paths it is supposed to be equal to u8 or u16, but
    it is not the case for the IB path record, where it can be
    multiple of struct ib_path_rec_data.
    
    This patch takes simplest possible approach and prevents providing
    values more than possible to allocate.
    
    Reported-by: syzbot+a38b0e9f694c379ca7ce@syzkaller.appspotmail.com
    Fixes: 7ce86409 ("RDMA/ucma: Allow user space to set service type")
    Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    6a21dfc0
ucma.c 43.3 KB