Re: [patch 2/2 v2] IB/rxe: Fix mem_check_range integer overflow

Doug Ledford
2017-02-08T17:40:54Z

[-- Attachment #1: Type: text/plain, Size: 1363 bytes --]

On Tue, 2017-02-07 at 16:45 +0300, Dan Carpenter wrote:
> From: Eyal Itkin <eyal.itkin-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>
> Update the range check to avoid integer-overflow in edge case.
> Resolves CVE 2016-8636.
>
> Signed-off-by: Eyal Itkin <eyal.itkin-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> Signed-off-by: Dan Carpenter <dan.carpenter-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
> ---
> v2: I completely misread Eyal's first patch.
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c
> b/drivers/infiniband/sw/rxe/rxe_mr.c
> index 8cf38b253c37..37eea7441ca4 100644
> --- a/drivers/infiniband/sw/rxe/rxe_mr.c
> +++ b/drivers/infiniband/sw/rxe/rxe_mr.c
> @@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova,
> size_t length)
>
>   case RXE_MEM_TYPE_MR:
>   case RXE_MEM_TYPE_FMR:
> - return ((iova < mem->iova) ||
> - ((iova + length) > (mem->iova + mem-
> >length))) ?
> - -EFAULT : 0;
> + if (iova < mem->iova ||
> +     length > mem->length ||
> +     iova > mem->iova + mem->length - length)
> + return -EFAULT;
> + return 0;
>
>   default:
>   return -EFAULT;

Thanks, applied.

--
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
GPG KeyID: B826A3330E572FDD

Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 819 bytes --]