lkml.org 
[lkml]   [2015]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 149/172] splice: Apply generic position and size checks to each write
    Date
    From: Ben Hutchings <ben@decadent.org.uk>

    3.4.108-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    3.2.67-rc1 review patch. If anyone has any objections, please let me know.

    ------------------

    From: Ben Hutchings <ben@decadent.org.uk>

    We need to check the position and size of file writes against various
    limits, using generic_write_check(). This was not being done for
    the splice write path. It was fixed upstream by commit 8d0207652cbe
    ("->splice_write() via ->write_iter()") but we can't apply that.

    CVE-2014-7822

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    fs/ocfs2/file.c | 8 ++++++--
    fs/splice.c | 8 ++++++--
    2 files changed, 12 insertions(+), 4 deletions(-)

    diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
    index bc44ea5..dc79934 100644
    --- a/fs/ocfs2/file.c
    +++ b/fs/ocfs2/file.c
    @@ -2474,9 +2474,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };

    @@ -2486,6 +2484,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    out->f_path.dentry->d_name.len,
    out->f_path.dentry->d_name.name, len);

    + ret = generic_write_checks(out, ppos, &len, 0);
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    if (pipe->inode)
    mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);

    diff --git a/fs/splice.c b/fs/splice.c
    index bed6a3c..67c5210 100644
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -991,13 +991,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };
    ssize_t ret;

    + ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    pipe_lock(pipe);

    splice_from_pipe_begin(&sd);
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-06-16 11:01    [W:4.039 / U:0.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site