Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1573410

Re: [PATCH] scatterlist: don't overflow length field

Show all headers | View raw

On Wed, Feb 1, 2017 at 1:29 PM, David Dillow <dillow@google.com> wrote:
> When called with a region of contiguous pages totaling > 4 GB of memory,
> sg_alloc_table_from_pages() will overflow the length field, leading to a
> corrupt scatter list. Fix this by tracking the number of pages we've
> merged and start a new chunk when we would overflow.

So what allows these things to be built in the first place?

We limit IO sizes to fit in a signed int (so just below 2GB) not only
because it's often an effective denial of service, but also because
we've had issues with various drivers (and filesystems) getting
int/long wrong.

So nothing should be building those kinds of scatterlists, and it
something is able to, it might result in other problems downstreams..

Put another way: why not just say "this can't happen", and make the
sg_alloc_table_from_pages() perhaps also have the same check.

MAX_RW_COUNT is what we limit reads and writes to:

    #define MAX_RW_COUNT (INT_MAX & PAGE_MASK)

Hmm?

                   Linus

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] scatterlist: don't overflow length field David Dillow <dillow@google.com> - 2017-02-01 22:30 +0100
  Re: [PATCH] scatterlist: don't overflow length field Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-03 21:00 +0100
    Re: [PATCH] scatterlist: don't overflow length field David Dillow <dillow@google.com> - 2017-02-06 19:40 +0100

csiph-web