diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2015-04-08 17:40:17 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-04-08 18:30:21 +0200 |
| commit | aadd51aa71f8d013c818a312bb2a0c5714830dbc (patch) | |
| tree | 28ca52d17183cb1d732b1324fce4f7b5d6b3dfc0 /drivers/infiniband/core/umem.c | |
| parent | netfilter: nf_tables: support optional userdata for set elements (diff) | |
| parent | hv_netvsc: Fix the packet free when it is in skb headroom (diff) | |
| download | linux-dev-aadd51aa71f8d013c818a312bb2a0c5714830dbc.tar.xz linux-dev-aadd51aa71f8d013c818a312bb2a0c5714830dbc.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
Resolve conflicts between 5888b93 ("Merge branch 'nf-hook-compress'") and
Florian Westphal br_netfilter works.
Conflicts:
net/bridge/br_netfilter.c
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'drivers/infiniband/core/umem.c')
| -rw-r--r-- | drivers/infiniband/core/umem.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index aec7a6aa2951..8c014b5dab4c 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, if (dmasync) dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. + */ + if ((PAGE_ALIGN(addr + size) <= size) || + (PAGE_ALIGN(addr + size) <= addr)) + return ERR_PTR(-EINVAL); + if (!can_do_mlock()) return ERR_PTR(-EPERM); |