Dan Rosenberg 218854af84 rds: Integer overflow in RDS cmsg handling ...

In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX.  This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation.  This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value.  If it somehow doesn't crash here, then memory
corruption could occur soon after.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2010-11-17 12:20:52 -08:00

..

af_rds.c

…

bind.c

…

cong.c

…

connection.c

…

ib_cm.c

…

ib_rdma.c

…

ib_recv.c

…

ib_ring.c

…

ib_send.c

…

ib_stats.c

…

ib_sysctl.c

…

ib.c

…

ib.h

…

info.c

…

info.h

…

iw_cm.c

…

iw_rdma.c

…

iw_recv.c

…

iw_ring.c

…

iw_send.c

…

iw_stats.c

…

iw_sysctl.c

…

iw.c

…

iw.h

…

Kconfig

…

loop.c

…

loop.h

…

Makefile

…

message.c

…

page.c

…

rdma_transport.c

…

rdma_transport.h

…

rdma.c

…

rds.h

…

recv.c

…

send.c

…

stats.c

…

sysctl.c

…

tcp_connect.c

…

tcp_listen.c

…

tcp_recv.c

…

tcp_send.c

…

tcp_stats.c

…

tcp.c

…

tcp.h

…

threads.c

…

transport.c

…

xlist.h

…