mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-09-30 21:26:15 +00:00
54 lines
1.6 KiB
Diff
54 lines
1.6 KiB
Diff
From 8096090858689395a75bbf696ff8276c3c236b98 Mon Sep 17 00:00:00 2001
|
|
From: Greg Kroah-Hartman <gregkh@google.com>
|
|
Date: Thu, 25 Feb 2016 12:15:48 -0800
|
|
Subject: [PATCH] AIO: properly check iovec sizes
|
|
|
|
commit ff19ac8fb71e8a2bf07d61b959062998139c1104 upstream
|
|
|
|
In Linus's tree, the iovec code has been reworked massively, but in
|
|
older kernels the AIO layer should be checking this before passing the
|
|
request on to other layers.
|
|
|
|
Many thanks to Ben Hawkes of Google Project Zero for pointing out the
|
|
issue.
|
|
|
|
Bug: 28588279
|
|
|
|
Reported-by: Ben Hawkes <hawkes@google.com>
|
|
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
|
|
Tested-by: Willy Tarreau <w@1wt.eu>
|
|
[backported to 3.10 - willy]
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
|
|
|
Change-Id: If539a08b42dd51a473b3f3743f9497e637266a05
|
|
---
|
|
fs/aio.c | 11 ++++++++---
|
|
1 file changed, 8 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/fs/aio.c b/fs/aio.c
|
|
index ded94c4fa30d3..9798d4edfd8f2 100644
|
|
--- a/fs/aio.c
|
|
+++ b/fs/aio.c
|
|
@@ -977,12 +977,17 @@ static ssize_t aio_setup_vectored_rw(int rw, struct kiocb *kiocb, bool compat)
|
|
|
|
static ssize_t aio_setup_single_vector(int rw, struct kiocb *kiocb)
|
|
{
|
|
- if (unlikely(!access_ok(!rw, kiocb->ki_buf, kiocb->ki_nbytes)))
|
|
- return -EFAULT;
|
|
+ size_t len = kiocb->ki_nbytes;
|
|
+
|
|
+ if (len > MAX_RW_COUNT)
|
|
+ len = MAX_RW_COUNT;
|
|
+
|
|
+ if (unlikely(!access_ok(!rw, kiocb->ki_buf, len)))
|
|
+ return -EFAULT;
|
|
|
|
kiocb->ki_iovec = &kiocb->ki_inline_vec;
|
|
kiocb->ki_iovec->iov_base = kiocb->ki_buf;
|
|
- kiocb->ki_iovec->iov_len = kiocb->ki_nbytes;
|
|
+ kiocb->ki_iovec->iov_len = len;
|
|
kiocb->ki_nr_segs = 1;
|
|
return 0;
|
|
}
|