• Dan Rosenberg's avatar
    rds: Integer overflow in RDS cmsg handling · 218854af
    Dan Rosenberg authored
    In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
    restricted to less than UINT_MAX.  This seems to need a tighter upper
    bound, since the calculation of total iov_size can overflow, resulting
    in a small sock_kmalloc() allocation.  This would probably just result
    in walking off the heap and crashing when calling rds_rdma_pages() with
    a high count value.  If it somehow doesn't crash here, then memory
    corruption could occur soon after.
    Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    218854af
rdma.c 22.5 KB