summaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/core/umem.c
diff options
context:
space:
mode:
authorDoug Ledford <dledford@redhat.com>2018-09-21 11:30:13 -0400
committerJason Gunthorpe <jgg@mellanox.com>2018-09-25 15:19:06 -0600
commitc6ce580716372d71cd119bacf73f14a62e9af2ea (patch)
treecfec93bc6ebd1580a7498589c05db2d516078b19 /drivers/infiniband/core/umem.c
parent3312d1c6bdee6aa912c099c0ac0662d197c52842 (diff)
downloadlinux-c6ce580716372d71cd119bacf73f14a62e9af2ea.tar.bz2
RDMA/umem: Fix potential addition overflow
Given a large enough memory allocation, it is possible to wrap the pinned_vm counter. Check for addition overflow to prevent such eventualities. Fixes: 40ddacf2dda9 ("RDMA/umem: Don't hold mmap_sem for too long") Reported-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Doug Ledford <dledford@redhat.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core/umem.c')
-rw-r--r--drivers/infiniband/core/umem.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 1886d7709911..8da1cf29a69f 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -85,6 +85,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
struct page **page_list;
struct vm_area_struct **vma_list;
unsigned long lock_limit;
+ unsigned long new_pinned;
unsigned long cur_base;
struct mm_struct *mm;
unsigned long npages;
@@ -160,12 +161,13 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
down_write(&mm->mmap_sem);
- mm->pinned_vm += npages;
- if ((mm->pinned_vm > lock_limit) && !capable(CAP_IPC_LOCK)) {
+ if (check_add_overflow(mm->pinned_vm, npages, &new_pinned) ||
+ (new_pinned > lock_limit && !capable(CAP_IPC_LOCK))) {
up_write(&mm->mmap_sem);
ret = -ENOMEM;
- goto vma;
+ goto out;
}
+ mm->pinned_vm = new_pinned;
up_write(&mm->mmap_sem);
cur_base = addr & PAGE_MASK;