diff options
| author | Yuhang Pan <242270054@hdu.edu.cn> | 2026-08-14 17:27:23 +0800 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-08-18 11:06:40 -0300 |
| commit | 60a42d510113f46de47e86a84bf5758597644487 (patch) | |
| tree | 4c747c473559ad54c8f416bbbce0291df5d00178 /scripts/objdiff | |
| parent | fab939caf8acfecdd4cfe84294dafcb9842a605f (diff) | |
| download | linux-60a42d510113f46de47e86a84bf5758597644487.tar.gz linux-60a42d510113f46de47e86a84bf5758597644487.zip | |
RDMA/uverbs: Guard legacy bundles without method_elm
The legacy write() path dispatches through a uverbs_api_write_method, but
the uverbs_attr_bundle passed to provider code does not have an ioctl
method element. If malformed provider input causes the common uverbs
validation code to emit an error message, uverbs_get_handler_fn()
dereferences the uninitialized method_elm pointer.
Initialize method_elm explicitly for legacy bundles and make
uverbs_get_handler_fn() return NULL when no ioctl method is present. The
legacy dispatcher continues to use its local write method, while the ioctl
path continues to use the registered ioctl handler.
Cc: stable@vger.kernel.org
Fixes: 7122ff96068a ("RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()")
Link: https://patch.msgid.link/r/AOYAQgCQK3IXqJLr1TB5Qao9.1.1787036796115.Hmail.242270054@hdu.edu.cn
Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions