infiniband/uverbs: Fix integer overflows

Browse source

The 'num_sge' variable is verfied to be smaller than the 'sge_count'
variable; however, since both are user-controlled it's possible to cause
an integer overflow for the kmalloc multiply on 32-bit platforms
(num_sge and sge_count are both defined u32). By crafting an input that
causes a smaller-than-expected allocation it's possible to write
controlled data out-of-bounds.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Doug Ledford <dledford@redhat.com>

...

This commit is contained in:

Vlad Tsyrklevich 2017-03-24 15:55:17 -04:00 • committed by Doug Ledford

parent 5b0ff9a007

commit 4f7f4dcfff

1 changed files with 12 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

13

drivers/infiniband/core/uverbs_cmd.c

View file