mirror-linux/include
Jason Gunthorpe 7122ff9606 RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()
Sashiko points out the legacy write path in ib_uverbs_write() does
allocate a struct uverbs_attr_bundle, but it doesn't wrap it in a
bundle_priv so downcasting here isn't safe.

Instead lift the method_elm out of the bundle_priv and use it for the
debug function. The legacy write path will leave it set as NULL since the
write method_elm uses a different type.

Cc: stable@vger.kernel.org
Fixes: 1de9287ece ("RDMA: Add ib_copy_validate_udata_in()")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-05-19 19:32:48 -03:00
..
acpi Merge branches 'acpi-apei', 'acpi-bus', 'acpi-cppc' and 'acpi-video' 2026-04-30 21:07:06 +02:00
asm-generic hyperv-next for v7.1 2026-04-22 09:50:46 -07:00
clocksource
crypto
cxl
drm amd-drm-fixes-7.1-2026-04-30: 2026-05-01 12:48:57 +10:00
dt-bindings We've finally gotten rid of the struct clk_ops::round_rate() code after months 2026-04-21 08:33:26 -07:00
hyperv x86/hyperv: Skip LP/VP creation on kexec 2026-04-22 06:23:25 +00:00
keys
kunit
kvm
linux bpf-fixes 2026-05-09 18:42:54 -07:00
math-emu
media
memory
misc
net Bluetooth: l2cap: defer conn param update to avoid conn->lock/hdev->lock inversion 2026-05-06 16:20:51 -04:00
pcmcia
ras
rdma RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() 2026-05-19 19:32:48 -03:00
rv
scsi
soc
sound ASoC: Fixes for v7.1 2026-04-23 09:34:28 +02:00
target
trace NFS client updates for Linux 7.1 2026-04-24 14:20:03 -07:00
uapi Miscellaneous scheduler fixes: 2026-05-08 19:42:10 -07:00
ufs scsi: ufs: core: Fix bRefClkFreq write failure in HS-LSS mode 2026-04-21 20:58:06 -04:00
vdso
video fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free 2026-05-04 10:35:55 +02:00
xen
Kbuild