AIO: properly check iovec sizes
Greg Kroah-Hartman [Sat, 20 Feb 2016 01:36:21 +0000 (17:36 -0800)]
In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Bug 1774591

Reported-by: Ben Hawkes <hawkes@google.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Willy Tarreau <w@1wt.eu>
[backported to 3.10 - willy]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ff19ac8fb71e8a2bf07d61b959062998139c1104)
Signed-off-by: Nitin Kumbhar <nkumbhar@nvidia.com>
Change-Id: Ia91c9dcbb605fefa8cd186bc0c896f1cd8aec4eb
Reviewed-on: http://git-master/r/1175560
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

fs/aio.c

index ded94c4..9798d4e 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -977,12 +977,17 @@ static ssize_t aio_setup_vectored_rw(int rw, struct kiocb *kiocb, bool compat)
 
 static ssize_t aio_setup_single_vector(int rw, struct kiocb *kiocb)
 {
-       if (unlikely(!access_ok(!rw, kiocb->ki_buf, kiocb->ki_nbytes)))
-               return -EFAULT;
+       size_t len = kiocb->ki_nbytes;
+
+       if (len > MAX_RW_COUNT)
+               len = MAX_RW_COUNT;
+
+       if (unlikely(!access_ok(!rw, kiocb->ki_buf, len)))
+                return -EFAULT;
 
        kiocb->ki_iovec = &kiocb->ki_inline_vec;
        kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-       kiocb->ki_iovec->iov_len = kiocb->ki_nbytes;
+       kiocb->ki_iovec->iov_len = len;
        kiocb->ki_nr_segs = 1;
        return 0;
 }