diff options
Diffstat (limited to 'kernel/include/rdma')
| -rw-r--r-- | kernel/include/rdma/ib.h | 16 | ||||
| -rw-r--r-- | kernel/include/rdma/ib_addr.h | 6 |
2 files changed, 20 insertions, 2 deletions
diff --git a/kernel/include/rdma/ib.h b/kernel/include/rdma/ib.h index cf8f9e700..a6b93706b 100644 --- a/kernel/include/rdma/ib.h +++ b/kernel/include/rdma/ib.h @@ -34,6 +34,7 @@ #define _RDMA_IB_H #include <linux/types.h> +#include <linux/sched.h> struct ib_addr { union { @@ -86,4 +87,19 @@ struct sockaddr_ib { __u64 sib_scope_id; }; +/* + * The IB interfaces that use write() as bi-directional ioctl() are + * fundamentally unsafe, since there are lots of ways to trigger "write()" + * calls from various contexts with elevated privileges. That includes the + * traditional suid executable error message writes, but also various kernel + * interfaces that can write to file descriptors. + * + * This function provides protection for the legacy API by restricting the + * calling context. + */ +static inline bool ib_safe_file_access(struct file *filp) +{ + return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS); +} + #endif /* _RDMA_IB_H */ diff --git a/kernel/include/rdma/ib_addr.h b/kernel/include/rdma/ib_addr.h index 11528591d..a78ff97eb 100644 --- a/kernel/include/rdma/ib_addr.h +++ b/kernel/include/rdma/ib_addr.h @@ -197,10 +197,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr, dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if); if (dev) { - ip4 = (struct in_device *)dev->ip_ptr; - if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) + ip4 = in_dev_get(dev); + if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) { ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address, (struct in6_addr *)gid); + in_dev_put(ip4); + } dev_put(dev); } } |