]> git.openfabrics.org - ~aditr/compat-rdma.git/commit
Added linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get...
authorVladimir Sokolovsky <vlad@mellanox.com>
Tue, 7 Apr 2015 10:25:11 +0000 (13:25 +0300)
committerVladimir Sokolovsky <vlad@mellanox.com>
Tue, 7 Apr 2015 10:25:11 +0000 (13:25 +0300)
commitbd88b3ff779fc5a28965a8d9988b73157421fe84
tree3b28f91f31dd5b9cef7cde913b2adaa95ec58a2d
parentba90d730b671fc781507e02aea3e0c2a24e7c269
Added linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch

IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic

Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.

Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.

This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.

Addresses: CVE-2014-8159
Cc: <stable@vger.kernel.org>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Vladimir Sokolovsky <vlad@mellanox.com>
linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch [new file with mode: 0644]