Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1341501
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 10/70] AIO: properly check iovec sizes |
| Date | 2016-02-24 06:10 +0100 |
| Message-ID | <r5zS1-84d-1@gated-at.bofh.it> (permalink) |
| References | <r5yVY-7pJ-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.
Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.
Reported-by: Ben Hawkes <hawkes@google.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/aio.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1375,11 +1375,16 @@ static ssize_t aio_setup_single_vector(s
unsigned long *nr_segs,
struct iovec *iovec)
{
- if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes)))
+ size_t len = kiocb->ki_nbytes;
+
+ if (len > MAX_RW_COUNT)
+ len = MAX_RW_COUNT;
+
+ if (unlikely(!access_ok(!rw, buf, len)))
return -EFAULT;
iovec->iov_base = buf;
- iovec->iov_len = kiocb->ki_nbytes;
+ iovec->iov_len = len;
*nr_segs = 1;
return 0;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/70] 3.14.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 36/70] iio: fix some warning messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 59/70] m32r: fix m32104ut_defconfig build fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 64/70] radix-tree: fix race in gang lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 39/70] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 04/70] phy: twl4030-usb: Relase usb phy on unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 50/70] fuse: break infinite loop in fuse_fill_write_pages() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 40/70] cifs: fix erroneous return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 05/70] wan/x25: Fix use-after-free in x25_asy_open_tty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 15/70] perf trace: Fix documentation for -i Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 57/70] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 67/70] intel_scu_ipcutil: underflow in scu_reg_access() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 49/70] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 63/70] memcg: only free spare array when readers are done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 58/70] xhci: Fix list corruption in urb dequeue at host removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 66/70] dump_stack: avoid potential deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 41/70] nfs: Fix race in __update_open_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 06/70] staging/speakup: Use tty_ldisc_ref() for paste kworker Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 70/70] module: wrapper for symbol name. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 43/70] udf: Prevent buffer overrun with multi-byte characters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 44/70] udf: Check output buffer length when converting name to CS0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100 [PATCH 3.14 10/70] AIO: properly check iovec sizes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 37/70] iio: adis_buffer: Fix out-of-bounds memory access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 03/70] ALSA: seq: Fix double port list deletion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 34/70] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 24/70] SCSI: Fix NULL pointer dereference in runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 29/70] scsi_dh_rdac: always retry MODE SELECT on command lock violation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 31/70] scsi: fix soft lockup in scsi_remove_target() on module removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 23/70] Fix a memory leak in scsi_host_dev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 30/70] SCSI: Add Marvell Console to VPD blacklist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 28/70] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 13/70] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 27/70] SCSI: fix crashes in sd and sr runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 35/70] iio: ad5064: Fix ad5629/ad5669 shift Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 25/70] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 32/70] iio:ad7793: Fix ad7785 product ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 26/70] iscsi-target: Fix potential dead-lock during node acl delete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 38/70] iio: dac: mcp4725: set iio name property in sysfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 11/70] ext4: fix potential integer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 33/70] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100 [PATCH 3.14 22/70] iscsi-target: Fix rx_login_comp hang after login failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:20 +0100 [PATCH 3.14 02/70] drm/i915: get runtime PM reference around GEM set_caching IOCTL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 19/70] klist: fix starting point removed bug in klist iterators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 18/70] tracing: Fix freak link error caused by branch tracer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 16/70] ptrace: use fsuid, fsgid, effective creds for fs access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 20/70] scsi: restart list search after unlock in scsi_remove_target Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 17/70] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 [PATCH 3.14 21/70] scsi_sysfs: Fix queue_ramp_up_period return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100 Re: [PATCH 3.14 00/70] 3.14.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-24 19:30 +0100 Re: [PATCH 3.14 00/70] 3.14.62-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-25 07:00 +0100
csiph-web