Re: [PATCH stable] pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic

[Greg KH <greg@kroah.com>]

On Tue, Jun 16, 2015 at 10:23:31PM +0100, Ben Hutchings wrote:
> pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec,
> the first time atomically and the second time not.  The second attempt
> needs to continue from the iovec position, pipe buffer offset and
> remaining length where the first attempt failed, but currently the
> pipe buffer offset and remaining length are reset.  This will corrupt
> the piped data (possibly also leading to an information leak between
> processes) and may also corrupt kernel memory.
> 
> This was fixed upstream by commits f0d1bec9d58d ("new helper:
> copy_page_from_iter()") and 637b58c2887e ("switch pipe_read() to
> copy_page_to_iter()"), but those aren't suitable for stable.
> 
> So 3.14.y and all earlier branches need a different fix.  I extracted
> the fix made by Seth Jennings for RHEL and have attached versions for
> 2.6.32.y and 3.2.y (tested) and 3.14.y (untested, just resolved a
> conflict there).  One or other of these should work for the other
> maintained branches.

Many thanks for these, now applied to 3.14 and 3.10-stable.

greg k-h