From patchwork Tue Mar 15 16:42:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 597702 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3qPgQQ4lcvz9t3v; Wed, 16 Mar 2016 03:42:38 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1afs3F-0003jL-SU; Tue, 15 Mar 2016 16:42:33 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1afs3B-0003j5-1o for kernel-team@lists.ubuntu.com; Tue, 15 Mar 2016 16:42:29 +0000 Received: from 1.general.kamal.us.vpn ([10.172.68.52] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1afs3A-0004sZ-J1; Tue, 15 Mar 2016 16:42:28 +0000 Received: from kamal by fourier with local (Exim 4.86) (envelope-from ) id 1afs37-0007Bv-QR; Tue, 15 Mar 2016 09:42:25 -0700 From: Kamal Mostafa To: Greg Kroah-Hartman Subject: [3.13.y-ckt stable] Patch "[stable-only] AIO: properly check iovec sizes" has been added to the 3.13.y-ckt tree Date: Tue, 15 Mar 2016 09:42:24 -0700 Message-Id: <1458060144-27608-1-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.0 X-Extended-Stable: 3.13 Cc: Kamal Mostafa , Moritz Muehlenhoff , kernel-team@lists.ubuntu.com, Benjamin LaHaise , Ben Hawkes X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled [stable-only] AIO: properly check iovec sizes to the linux-3.13.y-queue branch of the 3.13.y-ckt extended stable tree which can be found at: http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.13.y-queue This patch is scheduled to be released in version 3.13.11-ckt37. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.13.y-ckt tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ---8<------------------------------------------------------------ From 0a3fa9553aec368501dccf9fb02b45f103128de2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 19 Feb 2016 17:36:21 -0800 Subject: [stable-only] AIO: properly check iovec sizes In Linus's tree, the iovec code has been reworked massively, but in older kernels the AIO layer should be checking this before passing the request on to other layers. Many thanks to Ben Hawkes of Google Project Zero for pointing out the issue. Reported-by: Ben Hawkes Acked-by: Benjamin LaHaise Tested-by: Willy Tarreau Signed-off-by: Greg Kroah-Hartman Cc: Moritz Muehlenhoff Signed-off-by: Luis Henriques Signed-off-by: Kamal Mostafa --- fs/aio.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -- 2.7.0 diff --git a/fs/aio.c b/fs/aio.c index 08bcd65..775476b 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1272,11 +1272,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb, unsigned long *nr_segs, struct iovec *iovec) { - if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes))) + size_t len = kiocb->ki_nbytes; + + if (len > MAX_RW_COUNT) + len = MAX_RW_COUNT; + + if (unlikely(!access_ok(!rw, buf, len))) return -EFAULT; iovec->iov_base = buf; - iovec->iov_len = kiocb->ki_nbytes; + iovec->iov_len = len; *nr_segs = 1; return 0; }