rpms/kernel
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CVE-2014-8159 infiniband: uverbs: unprotected physical memory access (rhbz 1181166 1200950)

Browse Source
This commit is contained in:
Josh Boyer 2015-03-12 08:47:38 -04:00
parent c862073d93
commit 968be73b97
2 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch Normal file
View File

@ -0,0 +1,47 @@
From: Shachar Raindel <raindel@mellanox.com>
Date: Sun, 4 Jan 2015 18:30:32 +0200
Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address
arithmetic
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area
requested.
Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.
This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.
Issue: 470602
Change-Id: Iee88441db454af291fc5a376009d840603398d23
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
---
drivers/infiniband/core/umem.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index df0c4f605a21..dfa4286f98a4 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
if (dmasync)
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+ if ((PAGE_ALIGN(addr + size) <= size) ||
+ (PAGE_ALIGN(addr + size) <= addr))
+ return ERR_PTR(-EINVAL);
+
if (!can_do_mlock())
return ERR_PTR(-EPERM);
--
2.1.0

9
kernel.spec
View File

@ -787,6 +787,9 @@ Patch26165: xen-pciback-limit-guest-control-of-command-register.patch
#rhbz 1069027
Patch26166: drm-radeon-dp-Set-EDP_CONFIGURATION_SET-for-bridge-c.patch
#CVE-2014-8159 rhbz 1181166 1200950
Patch26167: IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
# END OF PATCH DEFINITIONS
%endif
@ -1537,6 +1540,9 @@ ApplyPatch xen-pciback-limit-guest-control-of-command-register.patch
#rhbz 1069027
ApplyPatch drm-radeon-dp-Set-EDP_CONFIGURATION_SET-for-bridge-c.patch
#CVE-2014-8159 rhbz 1181166 1200950
ApplyPatch IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
%if 0%{?aarch64patches}
ApplyPatch kernel-arm64.patch
%ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does.
@ -2355,6 +2361,9 @@ fi
# ||----w |
# || ||
%changelog
* Thu Mar 12 2015 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2014-8159 infiniband: uverbs: unprotected physical memory access (rhbz 1181166 1200950)
* Wed Mar 11 2015 Josh Boyer <jwboyer@fedoraproject.org>
- Fix blank screen after resume with various radeon devices (rhbz 1069027)
- CVE-2015-2150 xen: NMIs triggerable by guests (rhbz 1196266 1200397)