Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/infiniband/core
History
Dan Carpenter 201a79d6da RDMA/uverbs: Prevent integer overflow issue 
commit d0257e089d1bbd35c69b6c97ff73e3690ab149a9 upstream.

In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32
values that come from the user so the multiplication can lead to integer
wrapping.  Then we pass the result to uverbs_request_next_ptr() which also
could potentially wrap.  The "cmd.sge_count * sizeof(struct ib_uverbs_sge)"
multiplication can also overflow on 32bit systems although it's fine on
64bit systems.

This patch does two things.  First, I've re-arranged the condition in
uverbs_request_next_ptr() so that the use controlled variable "len" is on
one side of the comparison by itself without any math.  Then I've modified
all the callers to use size_mul() for the multiplications.

Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/b8765ab3-c2da-4611-aae0-ddd6ba173d23@stanley.mountain
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-15 16:29:56 +01:00
..
addr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
agent.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
agent.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cache.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cgroup.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cm.c RDMA/cm: Print the old state when cm_destroy_id gets timeout 2024-11-19 11:32:21 +01:00
cm_msgs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cm_trace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cm_trace.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma_configfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma_priv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma_trace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma_trace.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
core_priv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
counters.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
device.c RDMA/device: Return error earlier if port in not valid 2024-11-23 23:20:10 +01:00
ib_core_uverbs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iwcm.c Revert "RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency" 2024-11-24 00:23:21 +01:00
iwcm.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iwpm_msg.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iwpm_util.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iwpm_util.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lag.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mad.c Revert "RDMA/mad: Improve handling of timed out WRs of mad agent" 2024-11-24 00:22:58 +01:00
mad_priv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mad_rmpp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mad_rmpp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mr_pool.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
multicast.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netlink.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nldev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
opa_smi.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
packer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rdma_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rdma_core.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
restrack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
restrack.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
roce_gid_mgmt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sa.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sa_query.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
security.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smi.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ucma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ud_header.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
umem.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
umem_odp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_mad.c IB/core: Implement a limit on UMAD receive List 2024-11-19 14:19:40 +01:00
uverbs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_cmd.c RDMA/uverbs: Prevent integer overflow issue 2025-01-15 16:29:56 +01:00
uverbs_ioctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_main.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_marshall.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_async_fd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_counters.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_cq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_device.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_dm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_flow_action.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_mr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_qp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_srq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_std_types_wq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uverbs_uapi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verbs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00