48 lines
1.6 KiB
Diff
48 lines
1.6 KiB
Diff
|
From: Shachar Raindel <raindel@mellanox.com>
|
||
|
|
Date: Sun, 4 Jan 2015 18:30:32 +0200
|
||
|
|
Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address
|
||
|
|
arithmetic
|
||
|
|
|
||
|
|
Properly verify that the resulting page aligned end address is larger
|
||
|
|
than both the start address and the length of the memory area
|
||
|
|
requested.
|
||
|
|
|
||
|
|
Both the start and length arguments for ib_umem_get are controlled by
|
||
|
|
the user. A misbehaving user can provide values which will cause an
|
||
|
|
integer overflow when calculating the page aligned end address.
|
||
|
|
|
||
|
|
This overflow can cause also miscalculation of the number of pages
|
||
|
|
mapped, and additional logic issues.
|
||
|
|
|
||
|
|
Issue: 470602
|
||
|
|
Change-Id: Iee88441db454af291fc5a376009d840603398d23
|
||
|
|
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
|
||
|
|
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
|
||
|
|
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
|
||
|
|
---
|
||
|
|
drivers/infiniband/core/umem.c | 8 ++++++++
|
||
|
|
1 file changed, 8 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
|
||
|
|
index aec7a6aa2951..8c014b5dab4c 100644
|
||
|
|
--- a/drivers/infiniband/core/umem.c
|
||
|
|
+++ b/drivers/infiniband/core/umem.c
|
||
|
|
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
|
||
|
|
if (dmasync)
|
||
|
|
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
|
||
|
|
|
||
|
|
+ /*
|
||
|
|
+ * If the combination of the addr and size requested for this memory
|
||
|
|
+ * region causes an integer overflow, return error.
|
||
|
|
+ */
|
||
|
|
+ if ((PAGE_ALIGN(addr + size) <= size) ||
|
||
|
|
+ (PAGE_ALIGN(addr + size) <= addr))
|
||
|
|
+ return ERR_PTR(-EINVAL);
|
||
|
|
+
|
||
|
|
if (!can_do_mlock())
|
||
|
|
return ERR_PTR(-EPERM);
|
||
|
|
|
||
|
|
--
|
||
|
|
2.1.0
|
||
|
|
|