Fixes on top of CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest1 of 2 patches 4 repliesIn review
1 of 2 patches is in this archive. The cover letter announces 2.
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 2/2 | IB/core: don't disallow registering region starting at 0x0drivers/ | +2 | 4 replies |
Reviews trailers per patch
The patch has a Reviewed-by or Acked-by.
| Patch | Sagi Grimberg | Haggai Eran |
|---|---|---|
| 2/2 | R-b | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v1 0/2] Fixes on top of CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access
Hi,
Please find one patch to prevent a possible issue partially addressed by commit 8494057ab5e4 ("IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic") (see discussions in [1]) and another one to add back the possibility of registering memory mapped at 0 (which is probably not something to be allowed, but it's probably not up to ib_umem_get() to prevent it).
Changes from v0 [2]:
- don't touch to overflow logic in first patch:
not modifying the logic here so that the patch can be applied even on kernel without the overflow preventing checks, and second patch is going to rewrite the check.
- don't break overflow detection in second patch:
changing less or equal to less comparison broke the overflow detection logic regarding to rounding done by PAGE_ALIGN, so fixes this by checking for overflow in addr + size, then by checking for overflow in PAGE_ALIGN(addr + size).
[1] "Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access"
http://mid.gmane.org/[email protected]
http://marc.info/[email protected]
[2] [PATCH RESEND 0/2] Fixes on top of CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access
http://mid.gmane.org/[email protected]
http://marc.info/[email protected]
Yann Droneaud (2):
IB/core: disallow registering 0-sized memory region IB/core: don't disallow registering region starting at 0x0
drivers/infiniband/core/umem.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
Signature · 1 line
2.1.0