Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband (06459fc0) · Commits · 戴 / test

Pull infiniband/rdma fix from Roland Dreier: "Fix for exploitable integer overflow in uverbs interface" * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic

drivers/infiniband/core/umem.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -99,6 +99,14 @@ struct ib_umem ib_umem_get(struct ib_ucontext context, unsigned long addr,
		if (dmasync)
		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);

		/*
		* If the combination of the addr and size requested for this memory
		* region causes an integer overflow, return error.
		*/
		if ((PAGE_ALIGN(addr + size) <= size) \|\|
		(PAGE_ALIGN(addr + size) <= addr))
		return ERR_PTR(-EINVAL);

		if (!can_do_mlock())
		return ERR_PTR(-EPERM);

Admin message