v3.19.8-ckt17 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------ From: Greg Kroah-Hartman <[email protected]> In Linus's tree, the iovec code has been reworked massively, but in older kernels the AIO layer should be checking this before passing the request on to other layers. Many thanks to Ben Hawkes of Google Project Zero for pointing out the issue. Reported-by: Ben Hawkes <[email protected]> Acked-by: Benjamin LaHaise <[email protected]> Tested-by: Willy Tarreau <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Cc: Moritz Muehlenhoff <[email protected]> Signed-off-by: Luis Henriques <[email protected]> Signed-off-by: Kamal Mostafa <[email protected]> --- fs/aio.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index ebd0e9b..6a17d03 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1390,11 +1390,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb, unsigned long *nr_segs, struct iovec *iovec) { - if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes))) + size_t len = kiocb->ki_nbytes; + + if (len > MAX_RW_COUNT) + len = MAX_RW_COUNT; + + if (unlikely(!access_ok(!rw, buf, len))) return -EFAULT; iovec->iov_base = buf; - iovec->iov_len = kiocb->ki_nbytes; + iovec->iov_len = len; *nr_segs = 1; return 0; } -- 2.7.0
