Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Dan Carpenter 346db03e99 RDMA/uverbs: Prevent integer overflow issue ... commit d0257e089d upstream. In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications. Fixes: 67cdb40ca4 ("[IB] uverbs: Implement more commands") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/b8765ab3-c2da-4611-aae0-ddd6ba173d23@stanley.mountain Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-01-09 13:30:06 +01:00
..
core	RDMA/uverbs: Prevent integer overflow issue	2025-01-09 13:30:06 +01:00
hw	RDMA/hns: Fix missing flush CQE for DWQE	2025-01-09 13:29:59 +01:00
sw	RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs	2024-08-03 08:49:20 +02:00
ulp	RDMA/rtrs: Ensure 'ib_sge list' is accessible	2025-01-09 13:30:02 +01:00
Kconfig	RDMA: Disable IB HW for UML	2022-12-31 13:32:36 +01:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00