lkml.org 
[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 135/260] aio: check for multiplication overflow in do_io_submit
    Date
    From: Jeff Moyer <jmoyer@redhat.com>

    commit 75e1c70fc31490ef8a373ea2a4bea2524099b478 upstream.

    Tavis Ormandy pointed out that do_io_submit does not do proper bounds
    checking on the passed-in iocb array:

           if (unlikely(nr < 0))
                   return -EINVAL;

           if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(iocbpp)))))
                   return -EFAULT;                      ^^^^^^^^^^^^^^^^^^

    The attached patch checks for overflow, and if it is detected, the
    number of iocbs submitted is scaled down to a number that will fit in
    the long.  This is an ok thing to do, as sys_io_submit is documented as
    returning the number of iocbs submitted, so callers should handle a
    return value of less than the 'nr' argument passed in.

    Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
    Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    fs/aio.c | 3 +++
    1 files changed, 3 insertions(+), 0 deletions(-)

    diff --git a/fs/aio.c b/fs/aio.c
    index 48fdeeb..94b6cd6 100644
    --- a/fs/aio.c
    +++ b/fs/aio.c
    @@ -1659,6 +1659,9 @@ long do_io_submit(aio_context_t ctx_id, long nr,
    if (unlikely(nr < 0))
    return -EINVAL;

    + if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
    + nr = LONG_MAX/sizeof(*iocbpp);
    +
    if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
    return -EFAULT;

    --
    1.7.3.3
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2011-01-02 08:31    [W:0.021 / U:0.176 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site