linux/drivers/infiniband
Shachar Raindel 8494057ab5 IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.

Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.

This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.

Addresses: CVE-2014-8159
Cc: <stable@vger.kernel.org>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2015-04-02 09:53:59 -07:00
..
core IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic 2015-04-02 09:53:59 -07:00
hw IB/mlx4: Saturate RoCE port PMA counters in case of overflow 2015-03-18 15:17:11 -04:00
ulp Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-02-21 13:21:19 -08:00
Kconfig IB/core: Implement support for MMU notifiers regarding on demand paging regions 2014-12-15 18:13:36 -08:00
Makefile IB: Allow build of hw/ and ulp/ subdirectories independently 2014-06-02 14:51:12 -07:00