[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[34-longterm 135/260] aio: check for multiplication overflow in do_io_submit
    From: Jeff Moyer <>

    commit 75e1c70fc31490ef8a373ea2a4bea2524099b478 upstream.

    Tavis Ormandy pointed out that do_io_submit does not do proper bounds
    checking on the passed-in iocb array:

           if (unlikely(nr < 0))
                   return -EINVAL;

           if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(iocbpp)))))
                   return -EFAULT;                      ^^^^^^^^^^^^^^^^^^

    The attached patch checks for overflow, and if it is detected, the
    number of iocbs submitted is scaled down to a number that will fit in
    the long.  This is an ok thing to do, as sys_io_submit is documented as
    returning the number of iocbs submitted, so callers should handle a
    return value of less than the 'nr' argument passed in.

    Reported-by: Tavis Ormandy <>
    Signed-off-by: Jeff Moyer <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Paul Gortmaker <>
    fs/aio.c | 3 +++
    1 files changed, 3 insertions(+), 0 deletions(-)

    diff --git a/fs/aio.c b/fs/aio.c
    index 48fdeeb..94b6cd6 100644
    --- a/fs/aio.c
    +++ b/fs/aio.c
    @@ -1659,6 +1659,9 @@ long do_io_submit(aio_context_t ctx_id, long nr,
    if (unlikely(nr < 0))
    return -EINVAL;

    + if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
    + nr = LONG_MAX/sizeof(*iocbpp);
    if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
    return -EFAULT;

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2011-01-02 08:31    [W:0.020 / U:3.120 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site