| Date | Tue, 07 Dec 2010 16:43:08 -0800 | From | Greg KH <> | Subject | [002/127] block: limit vec count in bio_kmalloc() and bio_alloc_map_data() |
| |
2.6.32-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jens Axboe <jaxboe@fusionio.com>
commit f3f63c1c28bc861a931fac283b5bc3585efb8967 upstream.
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- fs/bio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
--- a/fs/bio.c +++ b/fs/bio.c @@ -371,6 +371,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, { struct bio *bio; + if (nr_iovecs > UIO_MAXIOV) + return NULL; + bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec), gfp_mask); if (unlikely(!bio)) @@ -701,8 +704,12 @@ static void bio_free_map_data(struct bio static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count, gfp_t gfp_mask) { - struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask); + struct bio_map_data *bmd; + + if (iov_count > UIO_MAXIOV) + return NULL; + bmd = kmalloc(sizeof(*bmd), gfp_mask); if (!bmd) return NULL;
|