Shachar Raindel 8494057ab5 IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic ... Properly verify that the resulting page aligned end address is larger than both the start address and the length of the memory area requested. Both the start and length arguments for ib_umem_get are controlled by the user. A misbehaving user can provide values which will cause an integer overflow when calculating the page aligned end address. This overflow can cause also miscalculation of the number of pages mapped, and additional logic issues. Addresses: CVE-2014-8159 Cc: <stable@vger.kernel.org> Signed-off-by: Shachar Raindel <raindel@mellanox.com> Signed-off-by: Jack Morgenstein <jackm@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Roland Dreier <roland@purestorage.com>		2015-04-02 09:53:59 -07:00
..
core	IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic	2015-04-02 09:53:59 -07:00
hw	IB/mlx4: Saturate RoCE port PMA counters in case of overflow	2015-03-18 15:17:11 -04:00
ulp	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2015-02-21 13:21:19 -08:00
Kconfig	IB/core: Implement support for MMU notifiers regarding on demand paging regions	2014-12-15 18:13:36 -08:00
Makefile	IB: Allow build of hw/ and ulp/ subdirectories independently	2014-06-02 14:51:12 -07:00