lkml.org 
[lkml]   [2013]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[11/85] zram: avoid access beyond the zram device
    3.2.49-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jiang Liu <liuj97@gmail.com>

    commit 12a7ad3b810e77137d0caf97a6dd97591e075b30 upstream.

    Function valid_io_request() should verify the entire request are within
    the zram device address range. Otherwise it may cause invalid memory
    access when accessing/modifying zram->meta->table[index] because the
    'index' is out of range. Then it may access non-exist memory, randomly
    modify memory belong to other subsystems, which is hard to track down.

    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/staging/zram/zram_drv.c | 17 ++++++++++++-----
    1 file changed, 12 insertions(+), 5 deletions(-)

    --- a/drivers/staging/zram/zram_drv.c
    +++ b/drivers/staging/zram/zram_drv.c
    @@ -541,13 +541,20 @@ out:
    */
    static inline int valid_io_request(struct zram *zram, struct bio *bio)
    {
    - if (unlikely(
    - (bio->bi_sector >= (zram->disksize >> SECTOR_SHIFT)) ||
    - (bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)) ||
    - (bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))) {
    + u64 start, end, bound;
    +
    + /* unaligned request */
    + if (unlikely(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)))
    + return 0;
    + if (unlikely(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))
    + return 0;

    + start = bio->bi_sector;
    + end = start + (bio->bi_size >> SECTOR_SHIFT);
    + bound = zram->disksize >> SECTOR_SHIFT;
    + /* out of range range */
    + if (unlikely(start >= bound || end >= bound || start > end))
    return 0;
    - }

    /* I/O request is valid */
    return 1;


    \
     
     \ /
      Last update: 2013-07-24 17:21    [W:3.271 / U:1.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site