[PATCH 4.8 61/67] IB/core: Avoid unsigned int overflow in sg_alloc_table

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.8 61/67] IB/core: Avoid unsigned int overflow in sg_alloc_table
Date	2016-11-24 16:40 +0100
Message-ID	<sH4hY-4Al-45@gated-at.bofh.it> (permalink)
References	<sH48h-4wC-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Bloch <markb@mellanox.com>

commit 3c7ba5760ab8eedec01159b267bb9bfcffe522ac upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e36c9 ("IB: Refactor umem to use linear SG table")
Signed-off-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/umem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -174,7 +174,7 @@ struct ib_umem *ib_umem_get(struct ib_uc
 
 	cur_base = addr & PAGE_MASK;
 
-	if (npages == 0) {
+	if (npages == 0 || npages > UINT_MAX) {
 		ret = -EINVAL;
 		goto out;
 	}

Thread

[PATCH 4.8 00/67] 4.8.11-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:30 +0100
  [PATCH 4.8 23/67] scripts/has-stack-protector: add -fno-PIE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 66/67] gpio: pca953x: Move memcpy into mutex lock for set multiple Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 62/67] IB/hfi1: Remove incorrect IS_ERR check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 34/67] clk: mmp: pxa910: fix return value check in pxa910_clk_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 33/67] virtio-net: drop legacy features in virtio 1 mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 38/67] rtc: omap: Fix selecting external osc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 04/67] arm64: KVM: pmu: Fix AArch32 cycle counter access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 60/67] IB/mlx5: Fix NULL pointer dereference on debug print Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 59/67] IB/mlx5: Fix fatal error dispatching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 61/67] IB/core: Avoid unsigned int overflow in sg_alloc_table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 07/67] ftrace: Add more checks for FTRACE_FL_DISABLED in processing ip records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 55/67] IB/mlx4: Fix create CQ error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 65/67] netfilter: nft_dynset: fix element timeout for HZ != 1000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 21/67] Disable the __builtin_return_address() warning globally after all Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 56/67] IB/mlx5: Validate requested RQT size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 64/67] IB/cm: Mark stale CM ids whenever the mad agent was unregistered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 47/67] PM / sleep: fix device reference leak in test_suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 37/67] clk: imx: fix integer overflow in AV PLL round rate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 36/67] clk: mmp: mmp2: fix return value check in mmp2_clk_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 35/67] clk: mmp: pxa168: fix return value check in pxa168_clk_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 46/67] uwb: fix device reference leaks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 67/67] gpio: pca953x: Fix corruption of other gpios in set_multiple. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 54/67] IB/mlx4: Check gid_index return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 25/67] kbuild: Steal gccs pie from the very beginning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 57/67] IB/mlx5: Use cache line size to select CQE stride Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 39/67] iwlwifi: pcie: fix SPLC structure parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 53/67] IB/rxe: Clear queue buffer when modifying QP to reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 63/67] IB/uverbs: Fix leak of XRC target QPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 58/67] IB/mlx5: Fix memory leak in query device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 08/67] genirq: Use irq type from irqdata instead of irqdesc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:40 +0100
  [PATCH 4.8 16/67] ALSA: usb-audio: Fix use-after-free of usb_device at disconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 49/67] perf hists: Fix column length on --hierarchy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 42/67] iwlwifi: mvm: fix d3_test with unified D0/D3 images Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 52/67] IB/rxe: Fix handling of erroneous WR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 18/67] ALSA: hda - Fix mic regression by ASRock mobo fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 44/67] mfd: core: Fix device reference leak in mfd_clone_cell Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 51/67] IB/rxe: Fix kernel panic in UDP tunnel with GRO and RX checksum Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 45/67] sunrpc: svc_age_temp_xprts_now should not call setsockopt non-tcp transports Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 43/67] iwlwifi: mvm: wake the wait queue when the RX sync counter is zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 10/67] IB/rdmavt: rdmavt can handle non aligned page maps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 50/67] IB/rxe: Update qp state for user query Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  [PATCH 4.8 48/67] PM / sleep: dont suspend parent when async child suspend_{noirq, late} fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-24 16:50 +0100
  Re: [PATCH 4.8 00/67] 4.8.11-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-25 01:50 +0100

csiph-web