lkml.org 
[lkml]   [2017]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] scatterlist: don't overflow length field
On Wed, Feb 1, 2017 at 1:29 PM, David Dillow <dillow@google.com> wrote:
> When called with a region of contiguous pages totaling > 4 GB of memory,
> sg_alloc_table_from_pages() will overflow the length field, leading to a
> corrupt scatter list. Fix this by tracking the number of pages we've
> merged and start a new chunk when we would overflow.

So what allows these things to be built in the first place?

We limit IO sizes to fit in a signed int (so just below 2GB) not only
because it's often an effective denial of service, but also because
we've had issues with various drivers (and filesystems) getting
int/long wrong.

So nothing should be building those kinds of scatterlists, and it
something is able to, it might result in other problems downstreams..

Put another way: why not just say "this can't happen", and make the
sg_alloc_table_from_pages() perhaps also have the same check.

MAX_RW_COUNT is what we limit reads and writes to:

#define MAX_RW_COUNT (INT_MAX & PAGE_MASK)

Hmm?

Linus

\
 
 \ /
  Last update: 2017-02-03 20:57    [W:0.054 / U:5.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site