From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756896AbcBXD7m (ORCPT ); Tue, 23 Feb 2016 22:59:42 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:51455 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756624AbcBXDyn (ORCPT ); Tue, 23 Feb 2016 22:54:43 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Hawkes , Benjamin LaHaise , Willy Tarreau Subject: [PATCH 3.10 06/54] AIO: properly check iovec sizes Date: Tue, 23 Feb 2016 19:33:23 -0800 Message-Id: <20160224033352.829037527@linuxfoundation.org> X-Mailer: git-send-email 2.7.1 In-Reply-To: <20160224033352.613205610@linuxfoundation.org> References: <20160224033352.613205610@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Kroah-Hartman In Linus's tree, the iovec code has been reworked massively, but in older kernels the AIO layer should be checking this before passing the request on to other layers. Many thanks to Ben Hawkes of Google Project Zero for pointing out the issue. Reported-by: Ben Hawkes Acked-by: Benjamin LaHaise Tested-by: Willy Tarreau [backported to 3.10 - willy] Signed-off-by: Greg Kroah-Hartman --- fs/aio.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/fs/aio.c +++ b/fs/aio.c @@ -977,12 +977,17 @@ static ssize_t aio_setup_vectored_rw(int static ssize_t aio_setup_single_vector(int rw, struct kiocb *kiocb) { - if (unlikely(!access_ok(!rw, kiocb->ki_buf, kiocb->ki_nbytes))) - return -EFAULT; + size_t len = kiocb->ki_nbytes; + + if (len > MAX_RW_COUNT) + len = MAX_RW_COUNT; + + if (unlikely(!access_ok(!rw, kiocb->ki_buf, len))) + return -EFAULT; kiocb->ki_iovec = &kiocb->ki_inline_vec; kiocb->ki_iovec->iov_base = kiocb->ki_buf; - kiocb->ki_iovec->iov_len = kiocb->ki_nbytes; + kiocb->ki_iovec->iov_len = len; kiocb->ki_nr_segs = 1; return 0; }