leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c095508770
linux/net/rds
History
Mohamed Ghannam c095508770 RDS: Heap OOB write in rds_message_alloc_sgs() 
When args->nr_local is 0, nr_pages gets also 0 due some size
calculation via rds_rm_size(), which is later used to allocate
pages for DMA, this bug produces a heap Out-Of-Bound write access
to a specific memory region.

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-01-03 11:23:05 -05:00
..
af_rds.c
bind.c RDS: make rhashtable_params const 2017-08-28 11:30:02 -07:00
cong.c
connection.c rds: reduce memory footprint for RDS when transport is RDMA 2017-08-03 09:27:59 -07:00
ib_cm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-03-15 11:59:10 -07:00
ib_fmr.c net/rds/ib_fmr.c: use kmalloc_array_node() 2017-11-15 18:21:02 -08:00
ib_frmr.c
ib_mr.h rds: ib: add the static type to the function 2017-03-13 23:20:05 -07:00
ib_rdma.c RDS: IB: Initialize max_items based on underlying device attributes 2017-10-05 21:16:33 -07:00
ib_recv.c rds: ib: Fix NULL pointer dereference in debug code 2017-11-10 14:54:47 +09:00
ib_ring.c
ib_send.c rds: Fix inaccurate accounting of unsignaled wrs 2017-10-26 17:35:57 +09:00
ib_stats.c
ib_sysctl.c
ib.c RDS: IB: Limit the scope of has_fr/has_fmr variables 2017-10-05 21:16:33 -07:00
ib.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
info.c
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig
loop.c
loop.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
message.c net, rds: convert rds_message.m_refcount from atomic_t to refcount_t 2017-07-04 22:35:18 +01:00
page.c
rdma_transport.c
rdma_transport.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rdma.c RDS: Heap OOB write in rds_message_alloc_sgs() 2018-01-03 11:23:05 -05:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rds.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recv.c net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t 2017-07-04 22:35:17 +01:00
send.c RDS: Check cmsg_len before dereferencing CMSG_DATA 2017-12-27 10:37:23 -05:00
stats.c
sysctl.c
tcp_connect.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_listen.c rds: tcp: use sock_create_lite() to create the accept socket 2017-07-08 11:16:16 +01:00
tcp_recv.c
tcp_send.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_stats.c
tcp.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
threads.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
transport.c rds: remove unnecessary returned value check 2017-03-03 09:51:22 -08:00