From 968be73b97cf62d1c1e95e30d323c50632d0e21d Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@fedoraproject.org>
Date: Mar 12 2015 12:50:31 +0000
Subject: CVE-2014-8159 infiniband: uverbs: unprotected physical memory access (rhbz 1181166 1200950)


---

diff --git a/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch b/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
new file mode 100644
index 0000000..406c3d5
--- /dev/null
+++ b/IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
@@ -0,0 +1,47 @@
+From: Shachar Raindel <raindel@mellanox.com>
+Date: Sun, 4 Jan 2015 18:30:32 +0200
+Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address
+ arithmetic
+
+Properly verify that the resulting page aligned end address is larger
+than both the start address and the length of the memory area
+requested.
+
+Both the start and length arguments for ib_umem_get are controlled by
+the user. A misbehaving user can provide values which will cause an
+integer overflow when calculating the page aligned end address.
+
+This overflow can cause also miscalculation of the number of pages
+mapped, and additional logic issues.
+
+Issue: 470602
+Change-Id: Iee88441db454af291fc5a376009d840603398d23
+Signed-off-by: Shachar Raindel <raindel@mellanox.com>
+Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+---
+ drivers/infiniband/core/umem.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index df0c4f605a21..dfa4286f98a4 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ 	if (dmasync)
+ 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ 
++	/*
++	 * If the combination of the addr and size requested for this memory
++	 * region causes an integer overflow, return error.
++	 */
++	if ((PAGE_ALIGN(addr + size) <= size) ||
++	    (PAGE_ALIGN(addr + size) <= addr))
++		return ERR_PTR(-EINVAL);
++
+ 	if (!can_do_mlock())
+ 		return ERR_PTR(-EPERM);
+ 
+-- 
+2.1.0
+
diff --git a/kernel.spec b/kernel.spec
index 835bb48..558c4bf 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -787,6 +787,9 @@ Patch26165: xen-pciback-limit-guest-control-of-command-register.patch
 #rhbz 1069027
 Patch26166: drm-radeon-dp-Set-EDP_CONFIGURATION_SET-for-bridge-c.patch
 
+#CVE-2014-8159 rhbz 1181166 1200950
+Patch26167: IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1537,6 +1540,9 @@ ApplyPatch xen-pciback-limit-guest-control-of-command-register.patch
 #rhbz 1069027
 ApplyPatch drm-radeon-dp-Set-EDP_CONFIGURATION_SET-for-bridge-c.patch
 
+#CVE-2014-8159 rhbz 1181166 1200950
+ApplyPatch IB-core-Prevent-integer-overflow-in-ib_umem_get-addr.patch
+
 %if 0%{?aarch64patches}
 ApplyPatch kernel-arm64.patch
 %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does.
@@ -2355,6 +2361,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu Mar 12 2015 Josh Boyer <jwboyer@fedoraproject.org>
+- CVE-2014-8159 infiniband: uverbs: unprotected physical memory access (rhbz 1181166 1200950)
+
 * Wed Mar 11 2015 Josh Boyer <jwboyer@fedoraproject.org>
 - Fix blank screen after resume with various radeon devices (rhbz 1069027)
 - CVE-2015-2150 xen: NMIs triggerable by guests (rhbz 1196266 1200397)