Re: [PATCH] RDS: Heap OOB write in rds_message_alloc_sgs()

2018-01-03 Thread David Miller
From: simo.ghan...@gmail.com Date: Tue, 2 Jan 2018 19:44:34 + > From: Mohamed Ghannam > > When args->nr_local is 0, nr_pages gets also 0 due some size > calculation via rds_rm_size(), which is later used to allocate > pages for DMA, this bug produces a heap Out-Of-Bound write access > to a

[PATCH] RDS: Heap OOB write in rds_message_alloc_sgs()

2018-01-02 Thread simo . ghannam
From: Mohamed Ghannam When args->nr_local is 0, nr_pages gets also 0 due some size calculation via rds_rm_size(), which is later used to allocate pages for DMA, this bug produces a heap Out-Of-Bound write access to a specific memory region. Signed-off-by: Mohamed Ghannam --- net/rds/rdma.c | 3