infiniband/uverbs: Fix integer overflows
authorVlad Tsyrklevich <vlad@tsyrklevich.net>
Fri, 24 Mar 2017 19:55:17 +0000 (15:55 -0400)
committerDoug Ledford <dledford@redhat.com>
Tue, 25 Apr 2017 19:18:02 +0000 (15:18 -0400)
commit4f7f4dcfff2c19debbcdbcc861c325610a15e0c5
treeb524532d61b62026a90ba8c21d44e58ae4c6dba4
parent5b0ff9a00755d4d9c209033a77f1ed8f3186fe5c
infiniband/uverbs: Fix integer overflows

The 'num_sge' variable is verfied to be smaller than the 'sge_count'
variable; however, since both are user-controlled it's possible to cause
an integer overflow for the kmalloc multiply on 32-bit platforms
(num_sge and sge_count are both defined u32). By crafting an input that
causes a smaller-than-expected allocation it's possible to write
controlled data out-of-bounds.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/core/uverbs_cmd.c