https://github.com/torvalds/linux
Revision 8494057ab5e40df590ef6ef7d66324d3ae33356b authored by Shachar Raindel on 18 March 2015, 17:39:08 UTC, committed by Roland Dreier on 02 April 2015, 16:53:59 UTC
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.

Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.

This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.

Addresses: CVE-2014-8159
Cc: <stable@vger.kernel.org>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
1 parent e42391c
History
Tip revision: 8494057ab5e40df590ef6ef7d66324d3ae33356b authored by Shachar Raindel on 18 March 2015, 17:39:08 UTC
IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
Tip revision: 8494057
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.2 KB
.mailmap -rw-r--r-- 4.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 94.0 KB
Kbuild -rw-r--r-- 2.1 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 298.9 KB
Makefile -rw-r--r-- 53.3 KB
README -rw-r--r-- 18.3 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top