This is a note to let you know that I've just added the patch titled
bio: take care not overflow page count when mapping/copying user data
to the 2.6.36-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bio-take-care-not-overflow-page-count-when-mapping-copying-user-data.patch
and it can be found in the queue-2.6.36 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From cb4644cac4a2797afc847e6c92736664d4b0ea34 Mon Sep 17 00:00:00 2001
From: Jens Axboe <[email protected]>
Date: Wed, 10 Nov 2010 14:36:25 +0100
Subject: bio: take care not overflow page count when mapping/copying user data
From: Jens Axboe <[email protected]>
commit cb4644cac4a2797afc847e6c92736664d4b0ea34 upstream.
If the iovec is being set up in a way that causes uaddr + PAGE_SIZE
to overflow, we could end up attempting to map a huge number of
pages. Check for this invalid input type.
Reported-by: Dan Rosenberg <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/bio.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -834,6 +834,12 @@ struct bio *bio_copy_user_iov(struct req
end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
start = uaddr >> PAGE_SHIFT;
+ /*
+ * Overflow, abort
+ */
+ if (end < start)
+ return ERR_PTR(-EINVAL);
+
nr_pages += end - start;
len += iov[i].iov_len;
}
@@ -962,6 +968,12 @@ static struct bio *__bio_map_user_iov(st
unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
unsigned long start = uaddr >> PAGE_SHIFT;
+ /*
+ * Overflow, abort
+ */
+ if (end < start)
+ return ERR_PTR(-EINVAL);
+
nr_pages += end - start;
/*
* buffer must be aligned to at least hardsector size for now
@@ -989,7 +1001,7 @@ static struct bio *__bio_map_user_iov(st
unsigned long start = uaddr >> PAGE_SHIFT;
const int local_nr_pages = end - start;
const int page_limit = cur_page + local_nr_pages;
-
+
ret = get_user_pages_fast(uaddr, local_nr_pages,
write_to_vm, &pages[cur_page]);
if (ret < local_nr_pages) {
Patches currently in stable-queue which might be from [email protected] are
queue-2.6.36/block-fix-race-during-disk-initialization.patch
queue-2.6.36/block-fix-accounting-bug-on-cross-partition-merges.patch
queue-2.6.36/block-limit-vec-count-in-bio_kmalloc-and-bio_alloc_map_data.patch
queue-2.6.36/bio-take-care-not-overflow-page-count-when-mapping-copying-user-data.patch
queue-2.6.36/block-check-for-proper-length-of-iov-entries-in-blk_rq_map_user_iov.patch
queue-2.6.36/block-take-care-not-to-overflow-when-calculating-total-iov-length.patch
queue-2.6.36/block-ensure-physical-block-size-is-unsigned-int.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
