iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

aio: sanitize the limit checking in io_submit(2)

Browse Source 
as it is, the logics in native io_submit(2) is "if asked for
more than LONG_MAX/sizeof(pointer) iocbs to submit, don't
bother with more than LONG_MAX/sizeof(pointer)" (i.e.
512M requests on 32bit and 1E requests on 64bit) while
compat io_submit(2) goes with "stop after the first
PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so.  Which is
	* inconsistent
	* *way* too much in native case
	* possibly too little in compat one
and
	* wrong anyway, since the natural point where we
ought to stop bothering is ctx->nr_events

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2018-05-26 20:10:07 -04:00
parent 67ba049f94
commit 1da92779e2
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/aio.c
View File

@ -1841,15 +1841,15 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
if (unlikely(nr < 0)) if (unlikely(nr < 0))
return -EINVAL; return -EINVAL;
if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
nr = LONG_MAX/sizeof(*iocbpp);
ctx = lookup_ioctx(ctx_id); ctx = lookup_ioctx(ctx_id);
if (unlikely(!ctx)) { if (unlikely(!ctx)) {
pr_debug("EINVAL: invalid context id\n"); pr_debug("EINVAL: invalid context id\n");
return -EINVAL; return -EINVAL;
} }
if (nr > ctx->nr_events)
nr = ctx->nr_events;
blk_start_plug(&plug); blk_start_plug(&plug);
for (i = 0; i < nr; i++) { for (i = 0; i < nr; i++) {
struct iocb __user *user_iocb; struct iocb __user *user_iocb;
@ -1870,8 +1870,6 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
} }
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
#define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))
COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id, COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
int, nr, compat_uptr_t __user *, iocbpp) int, nr, compat_uptr_t __user *, iocbpp)
{ {
@ -1883,15 +1881,15 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
if (unlikely(nr < 0)) if (unlikely(nr < 0))
return -EINVAL; return -EINVAL;
if (nr > MAX_AIO_SUBMITS)
nr = MAX_AIO_SUBMITS;
ctx = lookup_ioctx(ctx_id); ctx = lookup_ioctx(ctx_id);
if (unlikely(!ctx)) { if (unlikely(!ctx)) {
pr_debug("EINVAL: invalid context id\n"); pr_debug("EINVAL: invalid context id\n");
return -EINVAL; return -EINVAL;
} }
if (nr > ctx->nr_events)
nr = ctx->nr_events;
blk_start_plug(&plug); blk_start_plug(&plug);
for (i = 0; i < nr; i++) { for (i = 0; i < nr; i++) {
compat_uptr_t user_iocb; compat_uptr_t user_iocb;