From bd88b3ff779fc5a28965a8d9988b73157421fe84 Mon Sep 17 00:00:00 2001 From: Vladimir Sokolovsky Date: Tue, 7 Apr 2015 13:25:11 +0300 Subject: [PATCH] Added linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic Properly verify that the resulting page aligned end address is larger than both the start address and the length of the memory area requested. Both the start and length arguments for ib_umem_get are controlled by the user. A misbehaving user can provide values which will cause an integer overflow when calculating the page aligned end address. This overflow can cause also miscalculation of the number of pages mapped, and additional logic issues. Addresses: CVE-2014-8159 Cc: Signed-off-by: Shachar Raindel Signed-off-by: Jack Morgenstein Signed-off-by: Or Gerlitz Signed-off-by: Roland Dreier Signed-off-by: Vladimir Sokolovsky --- ...t-integer-overflow-in-ib_umem_get-ad.patch | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch diff --git a/linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch b/linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch new file mode 100644 index 0000000..62810ce --- /dev/null +++ b/linux-next-cherry-picks/0010-IB-uverbs-Prevent-integer-overflow-in-ib_umem_get-ad.patch @@ -0,0 +1,47 @@ +From 8494057ab5e40df590ef6ef7d66324d3ae33356b Mon Sep 17 00:00:00 2001 +From: Shachar Raindel +Date: Wed, 18 Mar 2015 17:39:08 +0000 +Subject: [PATCH] IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic + +Properly verify that the resulting page aligned end address is larger +than both the start address and the length of the memory area requested. + +Both the start and length arguments for ib_umem_get are controlled by +the user. A misbehaving user can provide values which will cause an +integer overflow when calculating the page aligned end address. + +This overflow can cause also miscalculation of the number of pages +mapped, and additional logic issues. + +Addresses: CVE-2014-8159 +Cc: +Signed-off-by: Shachar Raindel +Signed-off-by: Jack Morgenstein +Signed-off-by: Or Gerlitz +Signed-off-by: Roland Dreier +--- + drivers/infiniband/core/umem.c | 8 ++++++++ + 1 files changed, 8 insertions(+), 0 deletions(-) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index aec7a6a..8c014b5 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ /* ++ * If the combination of the addr and size requested for this memory ++ * region causes an integer overflow, return error. ++ */ ++ if ((PAGE_ALIGN(addr + size) <= size) || ++ (PAGE_ALIGN(addr + size) <= addr)) ++ return ERR_PTR(-EINVAL); ++ + if (!can_do_mlock()) + return ERR_PTR(-EPERM); + +-- +1.7.1 + -- 2.41.0