Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RDMA/core: Validate the passed in fops for ib_get_ucaps()

Browse source 
Sashiko pointed out it is not safe to rely only on the devt because
char/block alias so if the user finds a block device with the same dev_t
it can masquerade as a ucap cdev fd.

Test the f_ops to only accept authentic cdevs.

Link: https://patch.msgid.link/r/0-v1-fd9482545e37+1e25-ib_ucaps_fd_ops_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: 61e5168281 ("RDMA/uverbs: Introduce UCAP (User CAPabilities) API")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This commit is contained in:
Jason Gunthorpe 2026-05-26 12:40:25 -03:00
commit 4a1b1ac274
1 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/infiniband/core/ucaps.c
View file

@ -82,14 +82,12 @@ static int get_ucap_from_devt(dev_t devt, u64 *idx_mask)
static int get_devt_from_fd(unsigned int fd, dev_t *ret_dev)
{
struct file *file;
CLASS(fd, f)(fd);
file = fget(fd);
if (!file)
if (fd_empty(f) || fd_file(f)->f_op != &ucaps_cdev_fops)
return -EBADF;
*ret_dev = file_inode(file)->i_rdev;
fput(file);
*ret_dev = file_inode(fd_file(f))->i_rdev;
return 0;
}