linux-kernel - [PATCH 3.12 066/142] IB/core: disallow registering 0-sized memory region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <345726e427333c88b88ac8add3c0e6ab3120d21d.1431761807.git.jslaby@suse.cz>
Date:	Sat, 16 May 2015 09:37:06 +0200
From:	Jiri Slaby <jslaby@...e.cz>
To:	stable@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, Yann Droneaud <ydroneaud@...eya.com>,
	Shachar Raindel <raindel@...lanox.com>,
	Jack Morgenstein <jackm@...lanox.com>,
	Or Gerlitz <ogerlitz@...lanox.com>,
	Doug Ledford <dledford@...hat.com>, Jiri Slaby <jslaby@...e.cz>
Subject: [PATCH 3.12 066/142] IB/core: disallow registering 0-sized memory region

From: Yann Droneaud <ydroneaud@...eya.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.

If ib_umem_get() is called with a size equal to 0 and an
non-page aligned address, one page will be pinned and a
0-sized umem will be returned to the caller.

This should not be allowed: it's not expected for a memory
region to have a size equal to 0.

This patch adds a check to explicitly refuse to register
a 0-sized region.

Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
Cc: Shachar Raindel <raindel@...lanox.com>
Cc: Jack Morgenstein <jackm@...lanox.com>
Cc: Or Gerlitz <ogerlitz@...lanox.com>
Signed-off-by: Yann Droneaud <ydroneaud@...eya.com>
Signed-off-by: Doug Ledford <dledford@...hat.com>
Signed-off-by: Jiri Slaby <jslaby@...e.cz>
---
 drivers/infiniband/core/umem.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 055ebebc07dd..dccb9aac35c3 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 	if (dmasync)
 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+	if (!size)
+		return ERR_PTR(-EINVAL);
+
 	/*
 	 * If the combination of the addr and size requested for this memory
 	 * region causes an integer overflow, return error.
-- 
2.3.7

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/