Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

AIO: properly check iovec sizes 

In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Change-Id: I625e1b4376bb2342d6c5f88eb3f202e99a0c5b07
Reported-by: Ben Hawkes <hawkes@google.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Willy Tarreau <w@1wt.eu>
[backported to 3.10 - willy]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
This commit is contained in:
Greg Kroah-Hartman 2016-02-19 17:36:21 -08:00 committed by Gerrit - the friendly Code Review server
parent abe32f1ca0
commit 0e3800e931
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fs/aio.c
View File

@ -977,12 +977,17 @@ static ssize_t aio_setup_vectored_rw(int rw, struct kiocb *kiocb, bool compat)
static ssize_t aio_setup_single_vector(int rw, struct kiocb *kiocb)
{
if (unlikely(!access_ok(!rw, kiocb->ki_buf, kiocb->ki_nbytes)))
return -EFAULT;
size_t len = kiocb->ki_nbytes;
if (len > MAX_RW_COUNT)
len = MAX_RW_COUNT;
if (unlikely(!access_ok(!rw, kiocb->ki_buf, len)))
return -EFAULT;
kiocb->ki_iovec = &kiocb->ki_inline_vec;
kiocb->ki_iovec->iov_base = kiocb->ki_buf;
kiocb->ki_iovec->iov_len = kiocb->ki_nbytes;
kiocb->ki_iovec->iov_len = len;
kiocb->ki_nr_segs = 1;
return 0;
}