1 files changed, 8 insertions, 0 deletions

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index aec7a6aa2951..8c014b5dab4c 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
         if (dmasync)
                 dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+        /*
+         * If the combination of the addr and size requested for this memory
+         * region causes an integer overflow, return error.
+         */
+        if ((PAGE_ALIGN(addr + size) <= size) ||
+            (PAGE_ALIGN(addr + size) <= addr))
+                return ERR_PTR(-EINVAL);
+
         if (!can_do_mlock())
                 return ERR_PTR(-EPERM);