From patchwork Tue Mar 22 21:03:16 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 601001 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3qV4x01tlKz9s4x; Wed, 23 Mar 2016 08:05:56 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1aiTUv-0007E4-7B; Tue, 22 Mar 2016 21:05:53 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1aiTTF-0006aP-37 for kernel-team@lists.ubuntu.com; Tue, 22 Mar 2016 21:04:09 +0000 Received: from 1.general.kamal.us.vpn ([10.172.68.52] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1aiTTE-0007cQ-Fv; Tue, 22 Mar 2016 21:04:08 +0000 Received: from kamal by fourier with local (Exim 4.86) (envelope-from ) id 1aiTTB-0006Al-QU; Tue, 22 Mar 2016 14:04:05 -0700 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Subject: [PATCH 3.13.y-ckt 01/43] [stable-only] AIO: properly check iovec sizes Date: Tue, 22 Mar 2016 14:03:16 -0700 Message-Id: <1458680638-23644-2-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1458680638-23644-1-git-send-email-kamal@canonical.com> References: <1458680638-23644-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.13 Cc: Greg Kroah-Hartman , Kamal Mostafa , Moritz Muehlenhoff X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com 3.13.11-ckt37 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Greg Kroah-Hartman In Linus's tree, the iovec code has been reworked massively, but in older kernels the AIO layer should be checking this before passing the request on to other layers. Many thanks to Ben Hawkes of Google Project Zero for pointing out the issue. Reported-by: Ben Hawkes Acked-by: Benjamin LaHaise Tested-by: Willy Tarreau Signed-off-by: Greg Kroah-Hartman Cc: Moritz Muehlenhoff Signed-off-by: Luis Henriques Signed-off-by: Kamal Mostafa --- fs/aio.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 08bcd65..775476b 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1272,11 +1272,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb, unsigned long *nr_segs, struct iovec *iovec) { - if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes))) + size_t len = kiocb->ki_nbytes; + + if (len > MAX_RW_COUNT) + len = MAX_RW_COUNT; + + if (unlikely(!access_ok(!rw, buf, len))) return -EFAULT; iovec->iov_base = buf; - iovec->iov_len = kiocb->ki_nbytes; + iovec->iov_len = len; *nr_segs = 1; return 0; }