IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
authorMike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Tue, 12 Oct 2021 17:55:19 +0000 (13:55 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 2 Nov 2021 18:48:21 +0000 (19:48 +0100)
commitc3e17e58f571f34c51aeb17274ed02c2ed5cf780
tree40c54d1d02d9512f5acd0bc53b4c82d22f24bc64
parentee4908f909b3761ded2e32c79a6ea5ed20e1fdc6
IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields

commit d39bf40e55e666b5905fdbd46a0dced030ce87be upstream.

Overflowing either addrlimit or bytes_togo can allow userspace to trigger
a buffer overflow of kernel memory. Check for overflows in all the places
doing math on user controlled buffers.

Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
Link: https://lore.kernel.org/r/20211012175519.7298.77738.stgit@awfm-01.cornelisnetworks.com
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/hw/qib/qib_user_sdma.c