From mboxrd@z Thu Jan 1 00:00:00 1970 From: simo.ghannam@gmail.com Subject: [PATCH] RDS: Heap OOB write in rds_message_alloc_sgs() Date: Tue, 2 Jan 2018 19:44:34 +0000 Message-ID: <5a4be135.1296df0a.90c9.baea@mx.google.com> Cc: Mohamed Ghannam To: netdev@vger.kernel.org Return-path: Received: from mail-wr0-f193.google.com ([209.85.128.193]:43138 "EHLO mail-wr0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751014AbeABTo4 (ORCPT ); Tue, 2 Jan 2018 14:44:56 -0500 Received: by mail-wr0-f193.google.com with SMTP id w68so37102525wrc.10 for ; Tue, 02 Jan 2018 11:44:55 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: From: Mohamed Ghannam When args->nr_local is 0, nr_pages gets also 0 due some size calculation via rds_rm_size(), which is later used to allocate pages for DMA, this bug produces a heap Out-Of-Bound write access to a specific memory region. Signed-off-by: Mohamed Ghannam --- net/rds/rdma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/rds/rdma.c b/net/rds/rdma.c index bc2f1e0977d6..40a733566eb7 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c @@ -525,6 +525,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args) local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr; + if (args->nr_local == 0) + return -EINVAL; + /* figure out the number of pages in the vector */ for (i = 0; i < args->nr_local; i++) { if (copy_from_user(&vec, &local_vec[i], -- 2.14.1