| commit | d7a777500e5c2d0478bed0f5d81625ff69deea9e | |
| author | Dan Rosenberg <drosenberg@vsecurity.com> | |
| Wed, 17 Nov 2010 06:37:16 +0000 (17 06:37 +0000) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 21 Mar 2011 19:44:18 +0000 (21 12:44 -0700) | ||
| tree | 3b9ed0a137217999b774fcdafe6163ca2083d8ed | treesnapshot (tar.gz zip) |
| parent | 3f33eee5d6d77e4185d8e9a7a082da1a7c200064 | commitdiff |
rds: Integer overflow in RDS cmsg handling
commit 218854af84038d828a32f061858b1902ed2beec6 upstream.
In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX. This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation. This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value. If it somehow doesn't crash here, then memory
corruption could occur soon after.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 218854af84038d828a32f061858b1902ed2beec6 upstream.
In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX. This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation. This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value. If it somehow doesn't crash here, then memory
corruption could occur soon after.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| net/rds/rdma.c | diffblobblamehistory |