From patchwork Wed Nov 17 16:37:16 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Rosenberg X-Patchwork-Id: 71586 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 727E2B7196 for ; Thu, 18 Nov 2010 03:37:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934883Ab0KQQhV (ORCPT ); Wed, 17 Nov 2010 11:37:21 -0500 Received: from mx1.vsecurity.com ([209.67.252.12]:63812 "EHLO mx1.vsecurity.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934831Ab0KQQhU (ORCPT ); Wed, 17 Nov 2010 11:37:20 -0500 Received: (qmail 55466 invoked from network); 17 Nov 2010 16:37:17 -0000 Received: from 75-144-181-206-newengland.hfc.comcastbusiness.net (HELO [172.20.64.61]) (drosenbe@[75.144.181.206]) (envelope-sender ) by mx1.vsecurity.com (qmail-ldap-1.03) with SMTP for ; 17 Nov 2010 16:37:17 -0000 Subject: [PATCH] Integer overflow in RDS cmsg handling From: Dan Rosenberg To: andy.grover@oracle.com Cc: netdev@vger.kernel.org, security@kernel.org Date: Wed, 17 Nov 2010 11:37:16 -0500 Message-ID: <1290011836.26402.37.camel@dan> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In rds_cmsg_rdma_args(), the user-provided args->nr_local value is restricted to less than UINT_MAX. This seems to need a tighter upper bound, since the calculation of total iov_size can overflow, resulting in a small sock_kmalloc() allocation. This would probably just result in walking off the heap and crashing when calling rds_rdma_pages() with a high count value. If it somehow doesn't crash here, then memory corruption could occur soon after. Signed-off-by: Dan Rosenberg --- net/rds/rdma.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/rds/rdma.c b/net/rds/rdma.c index 8920f2a..0a969f6 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c @@ -567,7 +567,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, goto out; } - if (args->nr_local > (u64)UINT_MAX) { + if (args->nr_local > (u64)UIO_MAXIOV) { ret = -EMSGSIZE; goto out; }