diff options
| author | Josh Boyer <jwboyer@fedoraproject.org> | 2015-03-12 08:47:38 -0400 |
|---|---|---|
| committer | Josh Boyer <jwboyer@fedoraproject.org> | 2015-03-12 08:47:38 -0400 |
| commit | 32dcd3a968405b9678a538d951a0789e8eeb51ea (patch) | |
| tree | 4683940f4f1f2d116aaff51937c3be4a559383a0 /IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch | |
| parent | ac03c510f03e736fe6d8a43b90ae66ff37c3a617 (diff) | |
| download | kernel-32dcd3a968405b9678a538d951a0789e8eeb51ea.tar.gz kernel-32dcd3a968405b9678a538d951a0789e8eeb51ea.tar.xz kernel-32dcd3a968405b9678a538d951a0789e8eeb51ea.zip | |
CVE-2014-8159 infiniband: uverbs: unprotected physical memory access (rhbz 1181166 1200950)
Diffstat (limited to 'IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch')
| -rw-r--r-- | IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch b/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch new file mode 100644 index 000000000..8f51675ea --- /dev/null +++ b/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch @@ -0,0 +1,47 @@ +From: Shachar Raindel <raindel@mellanox.com> +Date: Sun, 4 Jan 2015 18:30:32 +0200 +Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address + arithmetic + +Properly verify that the resulting page aligned end address is larger +than both the start address and the length of the memory area +requested. + +Both the start and length arguments for ib_umem_get are controlled by +the user. A misbehaving user can provide values which will cause an +integer overflow when calculating the page aligned end address. + +This overflow can cause also miscalculation of the number of pages +mapped, and additional logic issues. + +Issue: 470602 +Change-Id: Iee88441db454af291fc5a376009d840603398d23 +Signed-off-by: Shachar Raindel <raindel@mellanox.com> +Signed-off-by: Jack Morgenstein <jackm@mellanox.com> +Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> +--- + drivers/infiniband/core/umem.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index aec7a6aa2951..8c014b5dab4c 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ /* ++ * If the combination of the addr and size requested for this memory ++ * region causes an integer overflow, return error. ++ */ ++ if ((PAGE_ALIGN(addr + size) <= size) || ++ (PAGE_ALIGN(addr + size) <= addr)) ++ return ERR_PTR(-EINVAL); ++ + if (!can_do_mlock()) + return ERR_PTR(-EPERM); + +-- +2.1.0 + |