lkml.org 
[lkml]   [2010]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[057/127] bio: take care not overflow page count when mapping/copying user data
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Jens Axboe <jaxboe@fusionio.com>

    commit cb4644cac4a2797afc847e6c92736664d4b0ea34 upstream.

    If the iovec is being set up in a way that causes uaddr + PAGE_SIZE
    to overflow, we could end up attempting to map a huge number of
    pages. Check for this invalid input type.

    Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
    Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/bio.c | 14 +++++++++++++-
    1 file changed, 13 insertions(+), 1 deletion(-)

    --- a/fs/bio.c
    +++ b/fs/bio.c
    @@ -838,6 +838,12 @@ struct bio *bio_copy_user_iov(struct req
    end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
    start = uaddr >> PAGE_SHIFT;

    + /*
    + * Overflow, abort
    + */
    + if (end < start)
    + return ERR_PTR(-EINVAL);
    +
    nr_pages += end - start;
    len += iov[i].iov_len;
    }
    @@ -965,6 +971,12 @@ static struct bio *__bio_map_user_iov(st
    unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
    unsigned long start = uaddr >> PAGE_SHIFT;

    + /*
    + * Overflow, abort
    + */
    + if (end < start)
    + return ERR_PTR(-EINVAL);
    +
    nr_pages += end - start;
    /*
    * buffer must be aligned to at least hardsector size for now
    @@ -992,7 +1004,7 @@ static struct bio *__bio_map_user_iov(st
    unsigned long start = uaddr >> PAGE_SHIFT;
    const int local_nr_pages = end - start;
    const int page_limit = cur_page + local_nr_pages;
    -
    +
    ret = get_user_pages_fast(uaddr, local_nr_pages,
    write_to_vm, &pages[cur_page]);
    if (ret < local_nr_pages) {



    \
     
     \ /
      Last update: 2010-12-08 01:49    [W:4.055 / U:0.004 seconds]
    ©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site