linux-kernel - [PATCH 3.2 043/164] IB/core: disallow registering 0-sized memory region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1438473757.740876215@decadent.org.uk>
Date:	Sun, 02 Aug 2015 01:02:37 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:	akpm@...ux-foundation.org, "Jack Morgenstein" <jackm@...lanox.com>,
	"Shachar Raindel" <raindel@...lanox.com>,
	"Doug Ledford" <dledford@...hat.com>,
	"Yann Droneaud" <ydroneaud@...eya.com>,
	"Or Gerlitz" <ogerlitz@...lanox.com>
Subject: [PATCH 3.2 043/164] IB/core: disallow registering 0-sized memory
 region

3.2.70-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Yann Droneaud <ydroneaud@...eya.com>

commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.

If ib_umem_get() is called with a size equal to 0 and an
non-page aligned address, one page will be pinned and a
0-sized umem will be returned to the caller.

This should not be allowed: it's not expected for a memory
region to have a size equal to 0.

This patch adds a check to explicitly refuse to register
a 0-sized region.

Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
Cc: Shachar Raindel <raindel@...lanox.com>
Cc: Jack Morgenstein <jackm@...lanox.com>
Cc: Or Gerlitz <ogerlitz@...lanox.com>
Signed-off-by: Yann Droneaud <ydroneaud@...eya.com>
Signed-off-by: Doug Ledford <dledford@...hat.com>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/infiniband/core/umem.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_uc
 	if (dmasync)
 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+	if (!size)
+		return ERR_PTR(-EINVAL);
+
 	/*
 	 * If the combination of the addr and size requested for this memory
 	 * region causes an integer overflow, return error.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/